Product:
Cisco Secure Firewall Threat Defense
Summary
A vulnerability in the Snort 2 and Snort 3 deep packet inspection of Cisco Secure Firewall Threat Defense Software could allow an unauthenticated, remote attacker to bypass configured Snort rules and allow traffic onto the network that should have been dropped. This vulnerability is due to a logic error in the integration of the Snort Engine rules with Cisco Secure FTD Software. An attacker could exploit this vulnerability by sending crafted traffic to a targeted device that would hit configured Snort rules.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.8 | CVE-2026-20007 |
Exploitation
An attacker can exploit this vulnerability by sending specially crafted traffic to a targeted device. This traffic is designed to trigger the configured Snort rules, which may not function as intended due to the logic error in the integration of the Snort Engine rules. If successful, the attacker can bypass security measures and send traffic to the network that should have been denied.
Affected Products
- Snort 2: Vulnerable to logic errors in packet inspection that may allow traffic to bypass security rules.
- Snort 3: Similar vulnerabilities as Snort 2, affecting the deep packet inspection capabilities.
Mitigation
To mitigate this vulnerability, it is recommended to review and update the Snort rules and configurations in Cisco Secure Firewall Threat Defense Software. Regular updates and patches from Cisco should be applied to ensure that the system is protected against known vulnerabilities.