CVE-2021-1236: Multiple Cisco Products Snort Application Detection Engine Policy Bypass Vulnerability

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-01-13 · updated 2026-08-11
Weakness: CWE-670

Description

Multiple Cisco products are affected by a vulnerability in the Snort application detection engine that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. The vulnerability is due to a flaw in the detection algorithm. An attacker could exploit this vulnerability by sending crafted packets that would flow through an affected system. A successful exploit could allow the attacker to bypass the configured policies and deliver a malicious payload to the protected network.

Affected products

Cisco IOS XE: before 17.4.1 — fixed in 17.4.1
Cisco Firepower Management Center: 2.9.14.0, 2.9.14.14, 2.9.15, 2.9.16, 2.9.17
Cisco Firepower Threat Defense Software: before 6.5.0.5 — fixed in 6.5.0.5
Snort: before 2.9.14 — fixed in 2.9.14

How to fix

Upgrade to a fixed version: Cisco IOS XE 17.4.1; Cisco Firepower Threat Defense Software 6.5.0.5; Snort 2.9.14. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-1236 or the next vulnerability affects your stack