Cisco Utd Snort Ips Engine Software
Monthly
Denial of service in the Cisco Snort 3 detection engine allows remote, unauthenticated attackers to exhaust device resources and disrupt inspection services on any deployment actively processing attacker-influenced traffic - including Cisco Secure Firewall Threat Defense (FTD), the Cisco UTD Snort IPS engine, Cisco Cyber Vision, and upstream Open Source Snort 3. The flaw is rooted in uncontrolled resource consumption (CWE-400) and carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning only availability is impacted - there is no confidentiality or integrity loss and no code execution. No public exploit code or in-the-wild activity has been identified at time of analysis, and no CISA KEV listing exists; exploitation is gated by the requirement that the target actually sits inline as an IDS/IPS or firewall in a traffic-inspection path.
Remote denial of service in Cisco Snort 3-based inspection engines, including Cisco Secure Firewall Threat Defense, Cisco UTD Snort IPS Engine Software, Cisco Cyber Vision, and open-source Snort 3, allows unauthenticated remote attackers to crash or disrupt the inspection process by sending crafted traffic that triggers incorrect calculation errors (CWE-682). CVSS 3.1 scores this 7.5 High with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is availability-only with no confidentiality or integrity effect; exploitation requires the attacker's traffic to traverse an actively inspecting sensor. No KEV entry or public exploit data was supplied, and no public exploit identified at time of analysis.
Improper privilege management in Cisco Snort 3 allows a locally authenticated low-privilege attacker to escalate privileges on affected deployments, including Cisco Secure Firewall Threat Defense, Cisco UTD Snort IPS Engine, Cisco Cyber Vision, and Open Source Snort 3 installations. Exploitation requires an existing local foothold (AV:L, PR:L) with no user interaction, so the practical risk is post-compromise privilege escalation or abuse of malicious low-privilege local accounts rather than remote attack. No public exploit identified at time of analysis; no CISA KEV active-exploitation confirmation was provided.
Out-of-bounds write flaws in the Cisco Snort 3 inspection engine allow remote, unauthenticated attackers to corrupt memory in any deployment where Snort 3 parses attacker-reachable network traffic, potentially leading to arbitrary code execution or a denial-of-service condition in the inspection process. The affected code ships not only as the standalone open-source Snort 3 project but also embedded in Cisco Secure Firewall Threat Defense (FTD), the Cisco UTD Snort IPS engine, and Cisco Cyber Vision, so exposure spans both Cisco appliances and third-party deployments of the open-source engine. Cisco addressed the issues through hardening releases produced during an internal security review, but the advisory groups the findings without publishing per-defect trigger details, and no public exploit code has been identified at time of analysis; CVSS AC:H reflects that an attacker must land traffic on the specific vulnerable parsing path rather than send a trivially repeatable packet.
An infinite-loop flaw in the Snort 3 Detection Engine's GTP codec lets remote, unauthenticated attackers restart the detection engine and disrupt inspection by sending a single crafted, fragmented UDP datagram carrying GTP extension headers (CVSS 5.3, availability-only, CWE-835). Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) software, and Cisco UTD Snort IPS Engine software are all affected, but only deployments that actually inspect GTP traffic - typically mobile-core, telecom, or specifically configured sensor placements - are realistically reachable. No public exploit code or confirmed active exploitation was identified at time of analysis, and the outcome is a temporary detection-engine restart rather than host compromise; the practical risk is a window of lost or degraded inspection coverage.
Improper handling of nested GRE traffic in the Snort 3 Detection Engine allows unauthenticated, remote attackers to crash and restart the engine by sending a crafted GRE payload through an affected device, causing either an inspection bypass or a transient denial of service depending on how the device is configured. Affected deployments include Cisco Secure Firewall Threat Defense (FTD), the Cisco UTD Snort IPS Engine, Cisco Cyber Vision, the Cisco Umbrella Insights virtual appliance, and open-source Snort 3. No public exploit code or confirmed active exploitation was identified at time of analysis; the engine restarts automatically, so disruption is transient per triggering packet, keeping this a moderate-severity availability issue rather than a top-tier priority.
Cisco Snort 3's Teredo detection engine can be forced to restart by a crafted Teredo packet, interrupting packet inspection on Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD Snort IPS Engine Software deployments that actually inspect Teredo traffic. The issue is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L), but impact is availability-only: a temporary engine restart and inspection gap rather than persistent compromise or code execution. No public exploit was identified at time of analysis, and exploitation depends on the target's Snort engine receiving and parsing Teredo packets.
Unauthenticated remote attackers can force the Snort 3 Detection Engine in Cisco Secure Firewall Threat Defense, Cisco UTD Snort IPS Engine, and open-source Snort 3 to restart by sending crafted VBA data through traffic the engine inspects, producing a denial-of-service condition. The flaw is a stack-based buffer overflow (CWE-121) caused by improper range checking in the Snort 3 VBA Decompression Engine; exploitation requires Snort 3 inspection with VBA decompression enabled and visibility of attacker traffic. No public exploit was identified at time of analysis, and the assessed impact is limited to availability with a CVSS score of 5.8.
Crafted GRE packets can cause Cisco Snort 3's Detection Engine to restart, temporarily interrupting packet inspection in Cisco Secure Firewall Threat Defense, the Cisco UTD Snort IPS engine, and open-source Snort 3 deployments that inspect GRE traffic. The issue is incomplete error checking during GRE parsing and is reachable by unauthenticated remote attackers with no user interaction (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L). No public exploit was identified at time of analysis, and the practical constraint is that the malicious GRE packet must traverse a Snort-inspected path.
Denial of service in Cisco Snort 3 allows an unauthenticated, remote attacker to restart the detection engine by sending a single crafted UDP NetFlow packet, interrupting packet inspection. The issue affects Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD Snort IPS Engine Software when NetFlow detection is active and the crafted packet reaches the parser; Cisco rates it CVSS 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/A:L). This is a moderate-priority availability issue, with no public exploit identified at time of analysis, and exploitation depends on NetFlow traffic being in the sensor's inspection path.
Denial of service in Cisco Snort 3 allows unauthenticated remote attackers to restart the Snort 3 Detection Engine by sending crafted SMTP packets with malformed MIME header fields over an established connection. The defect is missing error checking during SMTP MIME header parsing (CWE-805), and successful exploitation only affects availability, forcing a restart that can briefly interrupt inspection. Affected deployments include Cisco Open Source Snort3, Secure Firewall Threat Defense (FTD) software, and UTD Snort IPS Engine software that actively inspect SMTP traffic; no public exploit has been identified at time of analysis.
Denial of service in the Cisco Snort 3 detection engine allows remote, unauthenticated attackers to exhaust device resources and disrupt inspection services on any deployment actively processing attacker-influenced traffic - including Cisco Secure Firewall Threat Defense (FTD), the Cisco UTD Snort IPS engine, Cisco Cyber Vision, and upstream Open Source Snort 3. The flaw is rooted in uncontrolled resource consumption (CWE-400) and carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning only availability is impacted - there is no confidentiality or integrity loss and no code execution. No public exploit code or in-the-wild activity has been identified at time of analysis, and no CISA KEV listing exists; exploitation is gated by the requirement that the target actually sits inline as an IDS/IPS or firewall in a traffic-inspection path.
Remote denial of service in Cisco Snort 3-based inspection engines, including Cisco Secure Firewall Threat Defense, Cisco UTD Snort IPS Engine Software, Cisco Cyber Vision, and open-source Snort 3, allows unauthenticated remote attackers to crash or disrupt the inspection process by sending crafted traffic that triggers incorrect calculation errors (CWE-682). CVSS 3.1 scores this 7.5 High with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is availability-only with no confidentiality or integrity effect; exploitation requires the attacker's traffic to traverse an actively inspecting sensor. No KEV entry or public exploit data was supplied, and no public exploit identified at time of analysis.
Improper privilege management in Cisco Snort 3 allows a locally authenticated low-privilege attacker to escalate privileges on affected deployments, including Cisco Secure Firewall Threat Defense, Cisco UTD Snort IPS Engine, Cisco Cyber Vision, and Open Source Snort 3 installations. Exploitation requires an existing local foothold (AV:L, PR:L) with no user interaction, so the practical risk is post-compromise privilege escalation or abuse of malicious low-privilege local accounts rather than remote attack. No public exploit identified at time of analysis; no CISA KEV active-exploitation confirmation was provided.
Out-of-bounds write flaws in the Cisco Snort 3 inspection engine allow remote, unauthenticated attackers to corrupt memory in any deployment where Snort 3 parses attacker-reachable network traffic, potentially leading to arbitrary code execution or a denial-of-service condition in the inspection process. The affected code ships not only as the standalone open-source Snort 3 project but also embedded in Cisco Secure Firewall Threat Defense (FTD), the Cisco UTD Snort IPS engine, and Cisco Cyber Vision, so exposure spans both Cisco appliances and third-party deployments of the open-source engine. Cisco addressed the issues through hardening releases produced during an internal security review, but the advisory groups the findings without publishing per-defect trigger details, and no public exploit code has been identified at time of analysis; CVSS AC:H reflects that an attacker must land traffic on the specific vulnerable parsing path rather than send a trivially repeatable packet.
An infinite-loop flaw in the Snort 3 Detection Engine's GTP codec lets remote, unauthenticated attackers restart the detection engine and disrupt inspection by sending a single crafted, fragmented UDP datagram carrying GTP extension headers (CVSS 5.3, availability-only, CWE-835). Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) software, and Cisco UTD Snort IPS Engine software are all affected, but only deployments that actually inspect GTP traffic - typically mobile-core, telecom, or specifically configured sensor placements - are realistically reachable. No public exploit code or confirmed active exploitation was identified at time of analysis, and the outcome is a temporary detection-engine restart rather than host compromise; the practical risk is a window of lost or degraded inspection coverage.
Improper handling of nested GRE traffic in the Snort 3 Detection Engine allows unauthenticated, remote attackers to crash and restart the engine by sending a crafted GRE payload through an affected device, causing either an inspection bypass or a transient denial of service depending on how the device is configured. Affected deployments include Cisco Secure Firewall Threat Defense (FTD), the Cisco UTD Snort IPS Engine, Cisco Cyber Vision, the Cisco Umbrella Insights virtual appliance, and open-source Snort 3. No public exploit code or confirmed active exploitation was identified at time of analysis; the engine restarts automatically, so disruption is transient per triggering packet, keeping this a moderate-severity availability issue rather than a top-tier priority.
Cisco Snort 3's Teredo detection engine can be forced to restart by a crafted Teredo packet, interrupting packet inspection on Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD Snort IPS Engine Software deployments that actually inspect Teredo traffic. The issue is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L), but impact is availability-only: a temporary engine restart and inspection gap rather than persistent compromise or code execution. No public exploit was identified at time of analysis, and exploitation depends on the target's Snort engine receiving and parsing Teredo packets.
Unauthenticated remote attackers can force the Snort 3 Detection Engine in Cisco Secure Firewall Threat Defense, Cisco UTD Snort IPS Engine, and open-source Snort 3 to restart by sending crafted VBA data through traffic the engine inspects, producing a denial-of-service condition. The flaw is a stack-based buffer overflow (CWE-121) caused by improper range checking in the Snort 3 VBA Decompression Engine; exploitation requires Snort 3 inspection with VBA decompression enabled and visibility of attacker traffic. No public exploit was identified at time of analysis, and the assessed impact is limited to availability with a CVSS score of 5.8.
Crafted GRE packets can cause Cisco Snort 3's Detection Engine to restart, temporarily interrupting packet inspection in Cisco Secure Firewall Threat Defense, the Cisco UTD Snort IPS engine, and open-source Snort 3 deployments that inspect GRE traffic. The issue is incomplete error checking during GRE parsing and is reachable by unauthenticated remote attackers with no user interaction (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L). No public exploit was identified at time of analysis, and the practical constraint is that the malicious GRE packet must traverse a Snort-inspected path.
Denial of service in Cisco Snort 3 allows an unauthenticated, remote attacker to restart the detection engine by sending a single crafted UDP NetFlow packet, interrupting packet inspection. The issue affects Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD Snort IPS Engine Software when NetFlow detection is active and the crafted packet reaches the parser; Cisco rates it CVSS 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/A:L). This is a moderate-priority availability issue, with no public exploit identified at time of analysis, and exploitation depends on NetFlow traffic being in the sensor's inspection path.
Denial of service in Cisco Snort 3 allows unauthenticated remote attackers to restart the Snort 3 Detection Engine by sending crafted SMTP packets with malformed MIME header fields over an established connection. The defect is missing error checking during SMTP MIME header parsing (CWE-805), and successful exploitation only affects availability, forcing a restart that can briefly interrupt inspection. Affected deployments include Cisco Open Source Snort3, Secure Firewall Threat Defense (FTD) software, and UTD Snort IPS Engine software that actively inspect SMTP traffic; no public exploit has been identified at time of analysis.