High severity · published Nov 15, 2024
CVE-2022-20685
Multiple Cisco Products Snort Modbus Denial of Service Vulnerability
7.5
CVSS
1.5%
EPSS
No
On KEV
Description
A vulnerability in the Modbus preprocessor of the Snort detection engine could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to an integer overflow while processing Modbus traffic. An attacker could exploit this vulnerability by sending crafted Modbus traffic through an affected device. A successful exploit could allow the attacker to cause the Snort process to hang, causing traffic inspection to stop.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Cisco Cyber Vision · Cisco
3.0.0; 3.0.2; 3.0.3; 3.0.1; 3.1.0; 3.0.4; +11 more · source: vendor
CF
Cisco Firepower Threat Defense Software · Cisco
6.2.3.14; 6.4.0.1; 6.2.3.7; 6.2.3; 6.4.0.2; 6.2.3.9; +34 more · source: vendor
CU
Cisco UTD SNORT IPS Engine Software · Cisco
3.17.1S; 16.12.3; Fuji-16.9.5; 16.12.4; 17.3.1a; 16.6.6; +34 more · source: vendor
CV
Cyber Vision · Cisco
3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.0.5; +11 more · source: NVD
SF
Secure Firewall Threat Defense · Cisco
6.2.3; 6.2.3.1; 6.2.3.2; 6.2.3.3; 6.2.3.4; 6.2.3.5; +34 more · source: NVD
UT
Unified Threat Defense Snort Intrusion Prevention System Engine · Cisco
3.17.0s; 3.17.1s; 16.6.1; 16.6.5; 16.6.6; 16.6.7a; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-20685
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-20685
Not Applicable
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sna-xss-NXOxDhRQ
Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-dos-9D3hJLuj
More from Cisco Cyber Vision
9.1
CVE-2025-20359
Multiple Cisco Products Snort 3 MIME Information Disclosure or Denial of Service Vulnerability
9.0
CVE-2026-20043
Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
7.8
CVE-2026-20291
Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
7.5
CVE-2026-20356
Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
7.5
CVE-2026-20236
Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
