Strix
26.1K

CVE-2024-20330

HIGHCVSS 7.5/10EPSS 0.67%

Last modified

CVE-2024-20330 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A vulnerability in the Snort 2 and Snort 3 TCP and UDP detection engine of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause memory corruption, which could cause the Snort detection engine to restart unexpectedly. This vulnerability is due to improper memory management when the Snort detection engine processes specific TCP or UDP packets. An attacker could exploit this vulnerability by sending crafted TCP or UDP packets through a device that is inspecting traffic using the Snort detection engine. EPSS estimates a 0.67% chance of exploitation in the next 30 days.

Description

A vulnerability in the Snort 2 and Snort 3 TCP and UDP detection engine of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause memory corruption, which could cause the Snort detection engine to restart unexpectedly. This vulnerability is due to improper memory management when the Snort detection engine processes specific TCP or UDP packets. An attacker could exploit this vulnerability by sending crafted TCP or UDP packets through a device that is inspecting traffic using the Snort detection engine. A successful exploit could allow the attacker to restart the Snort detection engine repeatedly, which could cause a denial of service (DoS) condition. The DoS condition impacts only the traffic through the device that is examined by the Snort detection engine. The device can still be managed over the network. Note: Once a memory block is corrupted, it cannot be cleared until the Cisco Firepower 2100 Series Appliance is manually reloaded. This means that the Snort detection engine could crash repeatedly, causing traffic that is processed by the Snort detection engine to be dropped until the device is manually reloaded.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
0.67%

47.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
CiscoFirepower Threat Defense7.0.0.0
CiscoFirepower Threat Defense7.0.0.1
CiscoFirepower Threat Defense7.0.1
CiscoFirepower Threat Defense7.0.1.1
CiscoFirepower Threat Defense7.0.2
CiscoFirepower Threat Defense7.0.2.1
CiscoFirepower Threat Defense7.0.3
CiscoFirepower Threat Defense7.0.4
CiscoFirepower Threat Defense7.0.5
CiscoFirepower Threat Defense7.0.6
CiscoFirepower Threat Defense7.0.6.1
CiscoFirepower Threat Defense7.0.6.2
CiscoFirepower Threat Defense7.0.6.3
CiscoFirepower Threat Defense7.1.0
CiscoFirepower Threat Defense7.1.0.1
CiscoFirepower Threat Defense7.1.0.3
CiscoFirepower Threat Defense7.2.0
CiscoFirepower Threat Defense7.2.0.1
CiscoFirepower Threat Defense7.2.1
CiscoFirepower Threat Defense7.2.2
CiscoFirepower Threat Defense7.2.3
CiscoFirepower Threat Defense7.2.4
CiscoFirepower Threat Defense7.2.4.1
CiscoFirepower Threat Defense7.2.5
CiscoFirepower Threat Defense7.2.5.1
CiscoFirepower Threat Defense7.2.5.2
CiscoFirepower Threat Defense7.2.6
CiscoFirepower Threat Defense7.2.7
CiscoFirepower Threat Defense7.2.8
CiscoFirepower Threat Defense7.2.8.1
CiscoFirepower Threat Defense7.3.0
CiscoFirepower Threat Defense7.3.1
CiscoFirepower Threat Defense7.3.1.1
CiscoFirepower Threat Defense7.3.1.2
CiscoFirepower Threat Defense7.4.1
CiscoFirepower Threat Defense7.4.1.1
CiscoFirepower Threat Defense7.4.2

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2024-20330?
A vulnerability in the Snort 2 and Snort 3 TCP and UDP detection engine of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause memory corruption, which could cause the Snort detection engine to restart unexpectedly. This vulnerability is due to improper memory management when the Snort detection engine processes specific TCP or UDP packets. An attacker could exploit this vulnerability by sending crafted TCP or UDP packets through a device that is inspecting traffic using the Snort detection engine. A successful exploit could allow the attacker to restart the Snort detection engine repeatedly, which could cause a denial of service (DoS) condition. The DoS condition impacts only the traffic through the device that is examined by the Snort detection engine. The device can still be managed over the network. Note: Once a memory block is corrupted, it cannot be cleared until the Cisco Firepower 2100 Series Appliance is manually reloaded. This means that the Snort detection engine could crash repeatedly, causing traffic that is processed by the Snort detection engine to be dropped until the device is manually reloaded.
How severe is CVE-2024-20330?
CVE-2024-20330 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 0.67% probability of exploitation in the next 30 days.
How do I fix CVE-2024-20330?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2024-20330?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST