EUVD-2026-107376
GHSA-3wgh-x32w-jgcc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted Teredo packet to device
-
ExploitSnort 3 parses Teredo during inspection
-
ExecutionIncomplete error checking is triggered
-
ImpactDetection Engine restarts, interrupting packet inspection (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target device's Snort 3 Detection Engine actually receives and inspects Teredo (IPv6 tunneling over UDP/3544) traffic - the crafted packet must reach and be parsed by the Teredo detection logic. This applies to Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) software, and Cisco UTD Snort IPS Engine software. No authentication (PR:N) and no user interaction (UI:N) are needed, and default inline inspection paths typically parse such traffic. Limiting factors: the attacker must be able to route a Teredo packet to the inspecting engine, and the impact is confined to a temporary engine restart/inspection gap (A:L) rather than persistent compromise; deployments that do not carry or inspect Teredo traffic are not realistically reachable. |
| Impact | This is a moderate-priority, availability-only denial-of-service issue, not a high-urgency flaw despite its unauthenticated remote reachability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L, base 5.8) shows a network-reachable, low-complexity, unauthenticated trigger, but impact is limited to a single availability metric (A:L) with no confidentiality or integrity effect - the Snort 3 Detection Engine merely restarts rather than granting code execution, so the 'incomplete error checking' maps to a DoS/crash rather than the memory-corruption RCE that the attached 'Buffer Overflow'/CWE-119 label might superficially suggest. Exploitation status: no public exploit identified at time of analysis - the input provides no KEV listing, no POC flag, and no EPSS score, so there is no evidence of active or automated exploitation. The scope change (S:C) reflects that a crash in the inspection engine degrades security coverage for traffic transiting the device, which is the main defensive concern here. Net: treat as a routine-to-moderate patch priority for exposed Cisco FTD/UTD/Snort 3 deployments that actually inspect Teredo traffic; it is a genuine availability risk to the security function but not a confidentiality/integrity emergency. EPSS is absent (not low - simply not provided), so probabilistic exploitation likelihood cannot be stated. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted Teredo (IPv6-over-UDP tunneling) packet across the network to a device whose Snort 3 engine inspects that traffic. Incomplete error checking while parsing the packet causes the Snort 3 Detection Engine to restart unexpectedly, briefly interrupting packet inspection and creating a denial-of-service condition. No public proof-of-concept or exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Cisco Snort 3's Teredo detection engine can be forced to restart by a crafted Teredo packet, interrupting packet inspection on Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD Snort IPS Engine Software deployments that actually inspect Teredo traffic. The issue is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L), but impact is availability-only: a temporary engine restart and inspection gap rather than persistent compromise or code execution. No public exploit was identified at time of analysis, and exploitation depends on the target's Snort engine receiving and parsing Teredo packets.
RemediationAI
Apply the fixed Snort 3, Cisco Secure Firewall Threat Defense, or Cisco UTD Snort IPS Engine release identified in Cisco's advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-misc-dos-6mB22qAK; the supplied data does not include an exact fixed version, so do not assume a version number from this analysis. If an immediate upgrade is not possible, reduce exposure by preventing untrusted Teredo traffic, especially UDP/3544, from reaching interfaces inspected by Snort, or by disabling Teredo detection in the relevant Snort policy when Teredo inspection is not operationally required. The trade-off is that blocking UDP/3544 can disrupt legitimate Teredo IPv6 transition traffic, while disabling Teredo detection removes visibility and coverage for that protocol. Monitor for unexpected Snort detection-engine restarts as a sign of attempted exploitation, and validate that inline inspection paths are not parsing Teredo traffic from untrusted networks until the fixed release is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Teredo is an IPv6 transition mechanism that tunnels IPv6 packets over UDP, conventionally on port 3544, so inspection engines must parse encapsulated IPv6 and related headers inside Teredo traffic. CVE-2026-20197 is rooted in incomplete error checking in Snort 3's Teredo detection logic; the assigned CWE-119 class points to improper restriction of operations within a memory buffer, but the confirmed observable effect in the advisory and assessment is a restart of the Snort 3 Detection Engine, not code execution. The CVSS scope-changed rating reflects that the detection engine's failure can affect the broader inspection service, yet confidentiality and integrity impacts are none and availability impact is low. Reachability is limited to deployments where crafted Teredo packets can reach the Snort inspection path; environments that do not carry or inspect Teredo traffic are not realistically exposed.
Know when Cisco Secure Firewall Threat Defense Ftd Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Crafted packet is delivered over the network with no auth or interaction (AV:N/AC:L/PR:N/UI:N); crashing the inspection engine degrades the device's security authority (S:C) with availability-only, self-recovering impact (A:L).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
Multiple Cisco products are affected by a vulnerability in the Snort 3 Teredo Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection.
This vulnerability is due to incomplete error checking when Snort 3 parses Teredo packets. An attacker could exploit this vulnerability by sending a crafted Teredo packet to a targeted device to be parsed by Snort. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a DoS condition.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Out-of-bounds write flaws in the Cisco Snort 3 inspection engine allow remote, unauthenticated attackers to corrupt memo
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Exploit-DB