EUVD-2026-107378
GHSA-vm6m-qmxg-cg2c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRoute crafted traffic to affected device
-
ExploitSend nested GRE payload
-
ExecutionTrigger null pointer dereference in decapsulation
-
ImpactSnort 3 engine reloads, bypass or DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the affected Cisco device (Secure Firewall Threat Defense, UTD Snort IPS engine, Cyber Vision, Umbrella Insights virtual appliance, or open-source Snort 3) be processing and decapsulating GRE tunnel traffic, and that an attacker can route a crafted payload with improperly nested GRE encapsulation through that device. No authentication or user interaction is needed (PR:N/UI:N). Limiting factors: the device must actually handle GRE decapsulation in its inspection path, and the practical severity depends on configuration - a fail-open design yields an inspection bypass while a fail-closed design yields a DoS; the engine restarts automatically with no manual intervention, so disruption is transient per triggering packet. |
| Impact | This is a moderate-severity availability issue, not a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity, unauthenticated exploitation, which raises the ceiling, but the only impact is availability (A:L, C:N/I:N) via an automatic self-recovering restart of the Snort 3 Detection Engine (CWE-476 null pointer dereference). The scope-change flag (S:C) is the most important signal: a crafted nested-GRE packet can momentarily knock out the inspection engine, and depending on device configuration this produces either a fail-open security bypass (traffic passing uninspected) or a fail-closed DoS - the bypass case is the more consequential outcome and is what justifies the elevated 5.8 score despite only 'LOW' availability impact. SSVC-style signals lean toward 'track' rather than 'act': no EPSS score was supplied, the vulnerability is NOT in CISA KEV, and no public exploit was provided, so exploitation is theoretical at analysis time. Technical impact is partial (engine restarts automatically, no manual intervention) and automatability is plausible given AC:L/PR:N, but the lack of exploitation evidence keeps real-world risk below the raw vector's implication. Note the potential signal conflict: Cisco scored this A:L with C:N/I:N, yet the described 'bypass' outcome arguably has downstream integrity/confidentiality consequences for protected systems - this is captured by S:C rather than the impact metrics, so defenders relying on fail-open configurations should treat the effective risk as higher than 'LOW availability' suggests. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted payload containing improperly nested GRE encapsulation through a Cisco device whose Snort 3 engine decapsulates GRE traffic. The malformed packet triggers a null pointer dereference that reloads the detection engine; during the restart window, traffic either passes uninspected (bypass) or is dropped (DoS) depending on configuration. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Improper handling of nested GRE traffic in the Snort 3 Detection Engine allows unauthenticated, remote attackers to crash and restart the engine by sending a crafted GRE payload through an affected device, causing either an inspection bypass or a transient denial of service depending on how the device is configured. Affected deployments include Cisco Secure Firewall Threat Defense (FTD), the Cisco UTD Snort IPS Engine, Cisco Cyber Vision, the Cisco Umbrella Insights virtual appliance, and open-source Snort 3. No public exploit code or confirmed active exploitation was identified at time of analysis; the engine restarts automatically, so disruption is transient per triggering packet, keeping this a moderate-severity availability issue rather than a top-tier priority.
RemediationAI
Apply the Snort 3 Detection Engine software updates identified in the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gre-JNpMHrTv; because the advisory does not specify a single fixed version in the available data, consult it for the exact patched release for each product line (FTD, UTD Snort IPS Engine, Cyber Vision, Umbrella Insights virtual appliance, and open-source Snort 3) before upgrading. Where patching must be staged, reduce exposure by disabling GRE decapsulation in the inspection policy (for example, removing GRE from the inspected tunnel protocols) so nested GRE traffic is not processed by the vulnerable code path - the trade-off is that GRE-encapsulated traffic will no longer be inspected, creating a visibility gap. As a further compensating control, block GRE (IP protocol 47) at network boundaries where GRE tunnels are not legitimately required, accepting that legitimate tunnel traffic will be dropped. Verify whether the deployment is fail-open or fail-closed so the expected behavior during an engine restart is understood, and monitor for repeated Snort 3 restart events as an indicator of triggered crashes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine and is classified as CWE-476 (NULL Pointer Dereference). When GRE-encapsulated packets are processed, Snort 3 decapsulates them to inspect the inner payload; improperly nested GRE encapsulation is not handled correctly and can result in dereferencing a NULL pointer, terminating the detection process. Because GRE decapsulation is a network-facing inspection path, the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L reflects a remotely reachable, low-complexity attack requiring no credentials or user interaction, with scope change and a low availability-only impact. The scope change reflects that the crash affects the detection engine component rather than only the inspected data path. The practical consequence is configuration-dependent: a fail-open design turns the restart into a temporary inspection bypass, while a fail-closed design yields a short denial-of-service condition. The engine restarts itself without manual intervention, so the impact per triggering packet is transient.
Know when Cisco Secure Firewall Threat Defense Ftd Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Remote unauthenticated crafted GRE traffic (AV:N/AC:L/PR:N/UI:N); engine crash affects protected network so S:C; only transient auto-recovering availability loss, no C/I to the engine itself (A:L).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected restart of the Snort 3 Detection Engine.
This vulnerability is due to improper handling of nested GRE traffic. An attacker could exploit this vulnerability by sending a crafted GRE payload through an affected device. A successful exploit could allow the attacker to trigger an unexpected reload of the Snort 3 Detection Engine, resulting in either a bypass or denial of service (DoS) condition, depending on device configuration. For more information, see the section of this advisory. The Snort 3 Detection Engine will restart automatically. No manual intervention is required.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Out-of-bounds write flaws in the Cisco Snort 3 inspection engine allow remote, unauthenticated attackers to corrupt memo
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Exploit-DB