CVE-2022-20685: 
Cisco Firepower Threat Defense (FTD) vulnerability analysis and mitigation

A vulnerability in the Modbus preprocessor of the Snort detection engine (CVE-2022-20685) was discovered that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on affected devices. The vulnerability, which was disclosed on January 19, 2022, affects all open source Snort project releases earlier than Release 2.9.19 and Release 3.1.11.0, as well as multiple Cisco products including FirePOWER Services Software, Firepower Threat Defense Software, and Meraki MX Series Software (Cisco Advisory).

The vulnerability is rated with a CVSS base score of 7.5 and is caused by an integer overflow issue while processing Modbus traffic. The flaw specifically affects the Modbus preprocessor component of the Snort detection engine, which when exploited can cause the Snort process to enter an infinite while loop (Hacker News, Cisco Advisory).

A successful exploitation of this vulnerability results in the Snort process hanging, causing traffic inspection to stop. For Meraki MX series devices, this leads to bypass of inspection services, potentially allowing malicious traffic to reach devices behind the MX series device without generating alerts. In the case of Cyber Vision, the exploitation results in the bypass of Snort intrusion detection services, though deep packet inspection and anomaly detection services remain unaffected (Cisco Advisory).

Cisco has released software updates that address this vulnerability. For FTD Software managed by Firepower Management Center, the Modbus preprocessor can be disabled to mitigate the attack vector. However, there are no other workarounds available for other affected products. Users are advised to upgrade to the fixed versions: Snort 2.9.19 or later for 2.x versions, and 3.1.11.0 or later for 3.x versions (Cisco Advisory).

The vulnerability was discovered and reported by Uri Katz of Claroty Research. According to security researchers, network analysis tools like Snort are considered an under-researched area that deserves more attention, especially as OT networks are increasingly being centrally managed by IT network analysts (Hacker News).