EUVD-2026-107358
GHSA-4376-j46p-qqm7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local account on Snort host
-
ExploitConnect to unauthenticated control channel socket
-
ExecutionIssue control commands / manipulate process memory
-
ImpactExecute arbitrary commands as Snort process user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have a local, low-privileged account on the host running Snort 3, and the Snort 3 control channel (command) socket must be present/enabled for that local user to connect to. The core condition is the socket's lack of authentication - any local user who can reach the control socket can issue commands. Limiting factors: no remote vector (local access mandatory, AV:L), so an initial foothold on the host is a prerequisite; impact severity scales with the privilege level Snort runs as (greatest where Snort runs as root or a privileged service account). No user interaction is required (UI:N). |
| Impact | This is a CVSS 7.8 (High) local privilege/command-execution flaw in the Snort 3 control channel socket, rooted in CWE-306 (missing authentication). The CVSS vector AV:L/AC:L/PR:L/UI:N confirms it requires local access with low privileges and no user interaction, with High impact to confidentiality, integrity, and availability (C:H/I:H/A:H) - consistent with the description's claim of arbitrary command execution and read/write of Snort process memory as the Snort process user. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided in the input, so exploitation probability and in-the-wild activity cannot be quantified from available signals. The requirement for pre-existing local access substantially lowers real-world risk versus a network-exploitable flaw: this is a local privilege-escalation / lateral-movement primitive, not a remotely wormable issue. Treat it as a genuine but context-dependent priority - high value on multi-user hosts or where Snort runs as a privileged user, lower on single-admin dedicated sensors. No conflicting signals were detected; the CVSS vector and description align cleanly (both indicate local access). |
| Exploit ScenarioDerived | A low-privileged local user on a host running Snort 3 connects to the unauthenticated control channel socket and, because the socket performs no authentication, issues control commands that cause arbitrary command execution in the context of the Snort 3 process user. On deployments where Snort runs as root or a privileged service account, this yields effective privilege escalation and the ability to read or write Snort process memory. No public exploit was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Local command execution in Cisco Snort 3 allows an authenticated low-privileged user to run arbitrary commands as the Snort process user by connecting to the unauthenticated control channel socket. This CWE-306 missing authentication flaw is rated CVSS 7.8 (High); exploitation requires local access to the host and the control socket to be enabled, and no public exploit has been identified at time of analysis.
RemediationAI
No vendor-released patch version is identified in the provided data; consult the Cisco advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-opensrc-snort3-2fXGJPfe for fixed releases. Until a patch is applied, restrict access to the Snort 3 control channel socket so that only the Snort service account and trusted administrators can connect-for example, by setting the socket's parent directory and socket file permissions to 0700/0600 and ensuring ownership by the Snort user. Disable the control channel entirely if it is not required for local management. Run Snort as a dedicated unprivileged user rather than root to reduce the impact of command execution. Trade-offs: tightening socket permissions can break legitimate local management or monitoring tools that rely on the control channel, and disabling it removes local command-and-control capability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Snort 3 control channel is a local socket used to send commands to the Snort process. CWE-306 (Missing Authentication for Critical Function) means the socket does not verify the identity or authorization of connecting local users, so any local user who can reach the socket can issue commands that the Snort process executes with its own privileges. The affected product is identified by CPE cpe:2.3:a:cisco:cisco_open_source_snort3:*:*:*:*:*:*:*:*. The attack is local (AV:L) and requires low privileges (PR:L) but no user interaction (UI:N); impact severity scales with the privilege level under which Snort runs.
Know when Cisco Open Source Snort3 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local socket access by an existing low-privileged user drives AV:L and PR:L; missing authentication makes exploitation reliable (AC:L); command execution and memory read/write yield C:H/I:H/A:H.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the control channel socket implementation of Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user.
This vulnerability is due to a lack of authentication when a local user connects to the Snort control channel socket. An attacker could exploit this vulnerability by connecting to the Snort 3 control channel socket as a local user. A successful exploit could allow the attacker to execute arbitrary commands as well as read and write Snort 3 process memory.
Executive ViewAI
Cisco Snort 3 carries a high-severity missing-authentication flaw in its local control channel that would let someone already holding a low-privileged account on a sensor host run commands as the Snort service account. Because Snort sensors are typically the organization's primary network detection layer, a successful compromise risks both tampering with intrusion detection and using the sensor as a foothold inside a monitored network segment. Leadership should care less about the technical mechanics than about the concentration of risk: a small number of unpatched, locally accessible IDS hosts underpin visibility across the entire estate.
No vendor-released patch identified at time of analysis. Interim mitigations: disable the control channel socket where not operationally required, or restrict it via filesystem permissions and localhost-only binding to the Snort service account; limit interactive local access to sensor hosts and remove unnecessary low-privileged accounts; isolate IDS/IPS hosts on a dedicated management segment; monitor for anomalous process creation under the Snort service user and alert on unexpected control socket connections.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Cisco Open Source Snort3
View allOut-of-bounds write flaws in the Cisco Snort 3 inspection engine allow remote, unauthenticated attackers to corrupt memo
Improper privilege management in Cisco Snort 3 allows a locally authenticated low-privilege attacker to escalate privile
Denial of service in the Cisco Snort 3 detection engine allows remote, unauthenticated attackers to exhaust device resou
Remote denial of service in Cisco Snort 3-based inspection engines, including Cisco Secure Firewall Threat Defense, Cisc
Unauthenticated remote attackers can force the Snort 3 Detection Engine in Cisco Secure Firewall Threat Defense, Cisco U
Memory management flaws in Cisco Snort 3's file-processing path allow remote, unauthenticated attackers to exhaust memor
Improper handling of nested GRE traffic in the Snort 3 Detection Engine allows unauthenticated, remote attackers to cras
Cisco Snort 3's Teredo detection engine can be forced to restart by a crafted Teredo packet, interrupting packet inspect
Crafted GRE packets can cause Cisco Snort 3's Detection Engine to restart, temporarily interrupting packet inspection in
Denial of service in Cisco Snort 3 allows an unauthenticated, remote attacker to restart the detection engine by sending
Denial of service in Cisco Snort 3 allows unauthenticated remote attackers to restart the Snort 3 Detection Engine by se
An infinite-loop flaw in the Snort 3 Detection Engine's GTP codec lets remote, unauthenticated attackers restart the det
Exploit-DB