CVE-2024-20363

Severity: medium (CVSS 5.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-22 · updated 2026-08-11
Weakness: CWE-290

Description

Multiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that could allow an unauthenticated, remote attacker to bypass the configured rules on an affected system. This vulnerability is due to incorrect HTTP packet handling. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass configured IPS rules and allow uninspected traffic onto the network.

Affected products

Cisco Firepower Threat Defense Software: 7.4.0
Cisco Snort: from 3.0.0-233 before 3.1.69.0 — fixed in 3.1.69.0
Cisco UTD SNORT IPS Engine Software: 17.6.4, 17.6.5, 17.12.1a, 17.12.2

How to fix

Upgrade to a fixed version: Cisco Snort 3.1.69.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-20363 or the next vulnerability affects your stack