If you have an ASA, WebVPN is enabled, OOTB. If you have an ASA that hasn't been updated today, you are vulnerable to DoS and RCE vulnerabilities. That is, as

If you have an ASA, WebVPN is enabled, OOTB. If you have an ASA that hasn't been updated today, you are vulnerable to DoS and RCE vulnerabilities. That is, as far as I'm concerned, about as bad as it gets (we've got, I dunno, several dozen of these). I realize that, like everything, CVSS scores aren't perfect. But as a general "how bad is this?" indicator, I do think it's useful and, in this case, the 10.0 does the job of pointing out, "It's bad".