EUVD-2026-107373
GHSA-9v2c-x8g8-r7m4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted GRE packet to device
-
ExploitSnort 3 parses packet with incomplete error checking
-
ImpactDetection engine restarts, packet inspection interrupted (DoS)
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires that the targeted Cisco device actively inspect GRE traffic with the Snort 3 Detection Engine, so the crafted GRE packet must traverse a network path that Snort parses (inline or monitored deployments of Secure Firewall Threat Defense, the UTD Snort IPS engine, or open-source Snort 3). No authentication is required (PR:N) and no user interaction is needed (UI:N), and default inspection configurations that process GRE are sufficient - there is no requirement for a non-default feature toggle stated in the description. The principal limiting factors are reachability (the malicious GRE packet must reach a Snort-inspected path) and that impact is confined to a temporary inspection outage from an engine restart rather than persistent compromise. |
| Impact | This is a genuine but moderate-priority availability issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L, score 5.8 MEDIUM) describes a remotely reachable, unauthenticated, low-complexity attack with no user interaction - attractive characteristics for an attacker - but the impact is strictly a temporary denial of service (A:L only; C:N, I:N), limited to an unexpected restart of the Snort 3 Detection Engine rather than code execution or data exposure. The Scope:Changed flag is significant: the vulnerable Snort engine sits in-path as a security control, so its restart interrupts packet inspection for all traffic it protects, which is why the score is elevated above a simple self-contained DoS. No EPSS score, CISA KEV entry, POC, or SSVC decision data was provided in the input, so exploitation likelihood cannot be quantified from signals - the assessment rests on the CVSS vector and vendor description alone. No public exploit identified at time of analysis. Note a data conflict: the input carries an 'Information Disclosure' tag, which directly contradicts the CVSS vector (C:N, no confidentiality impact) and the description (a restart/DoS) - this tag appears mislabeled and should not drive triage. Overall, treat as a patch-in-normal-cycle availability bug for inline security devices, prioritized higher where the affected Snort instance is a critical inspection chokepoint. |
| Exploit ScenarioDerived | An unauthenticated remote attacker crafts a malformed GRE packet and sends it along a network path that a Cisco device running the Snort 3 engine (e.g., Secure Firewall Threat Defense or a UTD/IPS deployment) inspects. Incomplete error checking in the GRE parser causes the Snort 3 Detection Engine to restart, briefly suspending packet inspection and potentially allowing other traffic to pass uninspected during the window. No public exploit code was identified at time of analysis, and the attack requires no authentication or user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Crafted GRE packets can cause Cisco Snort 3's Detection Engine to restart, temporarily interrupting packet inspection in Cisco Secure Firewall Threat Defense, the Cisco UTD Snort IPS engine, and open-source Snort 3 deployments that inspect GRE traffic. The issue is incomplete error checking during GRE parsing and is reachable by unauthenticated remote attackers with no user interaction (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L). No public exploit was identified at time of analysis, and the practical constraint is that the malicious GRE packet must traverse a Snort-inspected path.
RemediationAI
No exact fixed release is specified in the supplied data; use Cisco's advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-misc-dos-6mB22qAK to identify and install the fixed software for Snort 3, Secure Firewall Threat Defense, or the UTD Snort IPS engine. Until upgraded, reduce exposure by blocking or restricting GRE at network boundaries so only trusted, necessary GRE sources can reach Snort-inspected interfaces; the trade-off is loss of legitimate GRE connectivity or inspection coverage for those tunnels. If GRE inspection is not operationally required, remove GRE from the inspection policy or disable GRE processing on the affected sensor, accepting reduced visibility for GRE traffic and verifying that legitimate GRE-dependent services are not disrupted. Monitor for Detection Engine restarts and packet-inspection gaps as an indicator of attempted exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Snort 3 is Cisco's intrusion prevention/detection engine; its Detection Engine parses GRE-encapsulated packets when GRE inspection is enabled or traffic traverses an inspected path. The root cause falls under CWE-128 (wrap-around error), and Cisco describes the specific manifestation as incomplete error checking in GRE parsing, so malformed GRE fields can push the parser into an error path that restarts the engine instead of safely rejecting the packet. The changed-scope CVSS vector and C:N/I:N/A:L show the assessed effect is a limited availability outage of the inspection process, not confidentiality or integrity compromise; the supplied 'Information Disclosure' tag is not supported by the vector or description and should not be treated as a data-exposure finding. Affected CPEs cover Cisco open-source Snort 3, Cisco Secure Firewall Threat Defense (FTD) software, and Cisco UTD Snort IPS engine software.
Know when Cisco Secure Firewall Threat Defense Ftd Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Remote unauthenticated crafted packet (AV:N/AC:L/PR:N/UI:N); S:C because the in-path Snort control's restart affects protected traffic; A:L for temporary restart, no C/I impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
Multiple Cisco products are affected by a vulnerability in the Snort 3 Generic Routing Encapsulation (GRE) Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection.
This vulnerability is due to incomplete error checking when Snort 3 parses GRE packets. An attacker could exploit this vulnerability by sending a crafted GRE packet to a targeted device to be parsed by Snort. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a DoS condition.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Out-of-bounds write flaws in the Cisco Snort 3 inspection engine allow remote, unauthenticated attackers to corrupt memo
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Exploit-DB