A critical vulnerability exists in multiple Cisco software products including ASA, FTD, IOS, IOS XE, and IOS XR. This flaw is present within the web services of these affected devices. The vulnerability stems from inadequate validation of user-supplied input in HTTP requests. Unauthenticated attackers can exploit this in ASA and FTD software, while authenticated attackers with low privileges can exploit it in the others. Successful exploitation requires additional system information or overcoming existing mitigations. An attacker could then execute arbitrary code with root privileges. This could ultimately lead to a complete compromise of the affected device. Cisco has released software updates to fix this vulnerability. There are no available workarounds to mitigate this issue. Customers are strongly advised to upgrade to a fixed software release.