What’s Vulnerable › Vulnerabilities
CVE-2024-20342: Cisco Firepower Threat Defense Software Rate Filter Bypass Vulnerability
- Severity: high (CVSS 8.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-10-23 · updated 2026-08-11
- Weakness: CWE-1025
Description
Multiple Cisco products are affected by a vulnerability in the rate filtering feature of the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured rate limiting filter. This vulnerability is due to an incorrect connection count comparison. An attacker could exploit this vulnerability by sending traffic through an affected device at a rate that exceeds a configured rate filter. A successful exploit could allow the attacker to successfully bypass the rate filter. This could allow unintended traffic to enter the network protected by the affected device.
Affected products
- Cisco Firepower Threat Defense Software: before 7.0.6.2; from 7.2.0 before 7.2.6; from 7.4.0 before 7.4.2; 7.1.0, 7.3.0 — fixed in 7.0.6.2, 7.2.6, 7.4.2
- Cisco Snort: from 3.0.0.0 before 3.1.74.0 — fixed in 3.1.74.0
How to fix
Upgrade to a fixed version: Cisco Firepower Threat Defense Software 7.0.6.2, 7.2.6, 7.4.2; Cisco Snort 3.1.74.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-20342 or the next vulnerability affects your stack