Medium severity · published May 22, 2024
CVE-2024-20363
Multiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that could allow an unauthenticated, remote attacker to bypass…
5.8
CVSS
0.4%
EPSS
No
On KEV
Description
Multiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that could allow an unauthenticated, remote attacker to bypass the configured rules on an affected system. This vulnerability is due to incorrect HTTP packet handling. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass configured IPS rules and allow uninspected traffic onto the network.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Cisco Firepower Threat Defense Software · Cisco
7.4.0 · source: vendor
CU
Cisco UTD SNORT IPS Engine Software · Cisco
17.6.4; 17.6.5; 17.12.1a; 17.12.2 · source: vendor
SF
Secure Firewall Threat Defense · Cisco
7.4.0 · source: NVD
SN
Snort · Cisco
3.0.0-233 before 3.1.69.0 · source: NVD
UT
Unified Threat Defense Snort Intrusion Prevention System Engine · Cisco
17.6.4; 17.6.5; 17.12.1a; 17.12.2 · source: NVD
FT
Firepower Threat Defense · Cisco
7.4.0 · source: CISA
SI
Snort Intrusion Prevention System · Cisco
17.6.4; 17.6.5; 17.12.1a; 17.12.2 · source: CISA
Affected product
CF
Cisco Firepower Threat Defense Software
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-20363
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-20363
Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-ips-bypass-uE69KBMd
More from Cisco Firepower Threat Defense Software
9.1
CVE-2023-20269
Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability
8.6
CVE-2024-20353
Cisco ASA and FTD Denial of Service Vulnerability
6.0
CVE-2024-20359
Cisco ASA and FTD Privilege Escalation Vulnerability
5.8
CVE-2024-20481
Cisco ASA and FTD Denial-of-Service Vulnerability
9.0
CVE-2025-20363
A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software,…
