Product:
Snort 3 Detection Engine
Summary
Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulnerability is due to incomplete parsing of the SSL handshake ingress packets. An attacker could exploit this vulnerability by sending crafted SSL handshake packets, leading to a denial of service condition.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.8 | CVE-2026-20005 |
Exploitation
To exploit this vulnerability, an attacker must send specially crafted SSL handshake packets to the Snort 3 Detection Engine. If successful, this could cause the engine to restart unexpectedly, leading to a denial of service condition where packet inspection is interrupted.
Affected Products
- Snort 3 Detection Engine: Vulnerable to denial of service due to incomplete parsing of SSL handshake packets.
Mitigation
To mitigate this vulnerability, it is recommended to apply any available patches from Cisco and ensure that the Snort 3 Detection Engine is configured securely. Regular monitoring and updating of the system can help prevent exploitation.