Cisco's exploited VPN crash flaw needs a tunnel-group check ASA and FTD firewalls need fixed software when reachable SSL VPN processing uses secondary authentication. Hiding connection profiles alone can leave the default group exposed.