Cisco Umbrella Insights Virtual Appliance
Monthly
Improper handling of nested GRE traffic in the Snort 3 Detection Engine allows unauthenticated, remote attackers to crash and restart the engine by sending a crafted GRE payload through an affected device, causing either an inspection bypass or a transient denial of service depending on how the device is configured. Affected deployments include Cisco Secure Firewall Threat Defense (FTD), the Cisco UTD Snort IPS Engine, Cisco Cyber Vision, the Cisco Umbrella Insights virtual appliance, and open-source Snort 3. No public exploit code or confirmed active exploitation was identified at time of analysis; the engine restarts automatically, so disruption is transient per triggering packet, keeping this a moderate-severity availability issue rather than a top-tier priority.
Privilege escalation in the Cisco Umbrella Virtual Appliance vmadmin CLI enables an authenticated local attacker holding vmadmin-level credentials to elevate access to root on the affected device. The flaw, classified as CWE-269 (Improper Privilege Management), arises because the vmadmin CLI does not adequately validate or restrict specific commands that can be leveraged as a privilege escalation path. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog at time of analysis; the CVSS 6.0 Medium score reflects the high-privilege prerequisite that meaningfully constrains the realistic attacker pool.
Improper handling of nested GRE traffic in the Snort 3 Detection Engine allows unauthenticated, remote attackers to crash and restart the engine by sending a crafted GRE payload through an affected device, causing either an inspection bypass or a transient denial of service depending on how the device is configured. Affected deployments include Cisco Secure Firewall Threat Defense (FTD), the Cisco UTD Snort IPS Engine, Cisco Cyber Vision, the Cisco Umbrella Insights virtual appliance, and open-source Snort 3. No public exploit code or confirmed active exploitation was identified at time of analysis; the engine restarts automatically, so disruption is transient per triggering packet, keeping this a moderate-severity availability issue rather than a top-tier priority.
Privilege escalation in the Cisco Umbrella Virtual Appliance vmadmin CLI enables an authenticated local attacker holding vmadmin-level credentials to elevate access to root on the affected device. The flaw, classified as CWE-269 (Improper Privilege Management), arises because the vmadmin CLI does not adequately validate or restrict specific commands that can be leveraged as a privilege escalation path. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog at time of analysis; the CVSS 6.0 Medium score reflects the high-privilege prerequisite that meaningfully constrains the realistic attacker pool.