CVE-2021-1495: Multiple Cisco Products Snort HTTP Detection Engine File Policy Bypass Vulnerability

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-04-29 · updated 2026-08-11
Weakness: CWE-755

Description

Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect handling of specific HTTP header parameters. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass a configured file policy for HTTP packets and deliver a malicious payload.

Affected products

Cisco IOS XE: from 16.12 before 16.12.5; from 17.1 before 17.3.3; from 17.4 before 17.4.1 — fixed in 16.12.5, 17.3.3, 17.4.1
Cisco Firepower Threat Defense Software: before 6.4.0.12; from 6.5.0 before 6.6.4; from 6.7.0 before 6.7.0.2 — fixed in 6.4.0.12, 6.6.4, 6.7.0.2
Snort: before 2.9.17.1 — fixed in 2.9.17.1

How to fix

Upgrade to a fixed version: Cisco IOS XE 16.12.5, 17.3.3, 17.4.1; Cisco Firepower Threat Defense Software 6.4.0.12, 6.6.4, 6.7.0.2; Snort 2.9.17.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-1495 or the next vulnerability affects your stack