CVE-2020-3299: Multiple Cisco Products SNORT HTTP Detection Engine File Policy Bypass Vulnerability

Severity: medium (CVSS 5.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-10-21 · updated 2026-08-11
Weakness: CWE-693

Description

Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured File Policy for HTTP. The vulnerability is due to incorrect detection of modified HTTP packets used in chunked responses. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass a configured File Policy for HTTP packets and deliver a malicious payload.

Affected products

Cisco Firepower Threat Defense Software: from 6.0.0 before 6.3.0.1 — fixed in 6.3.0.1
Snort: before 2.9.13.1 — fixed in 2.9.13.1

How to fix

Upgrade to a fixed version: Cisco Firepower Threat Defense Software 6.3.0.1; Snort 2.9.13.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-3299 or the next vulnerability affects your stack