CVE-2021-1223: Multiple Cisco Products Snort HTTP Detection Engine File Policy Bypass Vulnerability

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-01-13 · updated 2026-08-11
Weakness: CWE-693

Description

Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect handling of an HTTP range header. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass configured file policy for HTTP packets and deliver a malicious payload.

Affected products

Cisco IOS XE: before 17.4.1 — fixed in 17.4.1
Cisco Firepower Management Center: 2.9.14.0, 2.9.15, 2.9.16
Cisco Firepower Threat Defense Software: before 6.7.0 — fixed in 6.7.0
Snort: before 2.9.17 — fixed in 2.9.17

How to fix

Upgrade to a fixed version: Cisco IOS XE 17.4.1; Cisco Firepower Threat Defense Software 6.7.0; Snort 2.9.17. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-1223 or the next vulnerability affects your stack