Suricata EUVD-2026-75776

Exploitation requires the attacker to control or inject content into a Suricata rule file that the target instance will load or reload. Concretely, this means: (a) direct write access to a rule directory on the Suricata host (local admin equivalent), (b) control of a remote rule distribution feed that the Suricata instance pulls from (supply-chain scenario), or (c) the ability to trigger a rule reload after injecting a malicious rule. The vulnerability is limited by Suricata running with reduced OS privileges - if privilege dropping is configured, the writable filesystem paths are constrained. On systems where Suricata runs as root (common in inline IPS deployments), the impact is unrestricted file overwrite. Exploitation also requires the target to perform a rule load or reload after the malicious rule is in place; it does not trigger on in-flight traffic alone.

The vendor-assigned CVSS 3.1 score of 4.4 (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N) accurately captures the constrained exploitation path. PR:H reflects that exploitation requires the ability to supply or inject a rule - either direct filesystem write access to rule directories, compromise of an upstream rule feed (e.g., Emerging Threats Pro), or administrator-level access. AC:H is appropriate because the attacker must orchestrate the malicious rule reaching a target Suricata instance that loads it. Despite the I:H rating (arbitrary file overwrite, which could trivially escalate to RCE by overwriting init scripts, cron jobs, or SSH authorized_keys), the high privilege prerequisite substantially limits real-world attack surface. No EPSS data is available in the provided input, and this CVE is absent from CISA KEV with no public POC - both consistent with a medium-priority finding. The greatest realistic risk vector is a supply-chain compromise of a rule distribution feed, which would enable the network-level attack path implied by AV:N.

An attacker who has compromised an upstream Suricata rule feed (e.g., an ET Pro mirror or a self-hosted rule server) injects a crafted rule containing an absolute save path such as /etc/cron.d/backdoor. When the Suricata operator performs a rule reload (triggered automatically or manually), Suricata writes attacker-controlled content to that path, establishing persistence or overwriting a critical system file. No public POC is known but the technique is straightforward given rule control.