CVE-2022-20767: 
Cisco Firepower Threat Defense (FTD) vulnerability analysis and mitigation

A vulnerability (CVE-2022-20767) was discovered in the Snort rule evaluation function of Cisco Firepower Threat Defense (FTD) Software. This high-severity vulnerability, with a CVSS base score of 8.6, affects Cisco FTD devices running Snort 3 with DNS reputation enforcement enabled (Cisco Advisory).

The vulnerability stems from improper handling of the DNS reputation enforcement rule in Cisco FTD Software. The issue specifically affects devices running Snort 3, which is the default configuration for new installations of Cisco FTD releases 7.0.0 and later. DNS reputation enforcement, which was introduced in Cisco FTD Release 6.7, is enabled by default on Cisco FTD releases 6.7 and later (Cisco Advisory).

A successful exploitation of this vulnerability could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This would result in traffic passing through the affected device being dropped, potentially disrupting network operations (Cisco Advisory).

Cisco has released software updates that address this vulnerability. While there are no direct workarounds, administrators can disable DNS reputation enforcement as a mitigation measure. However, disabling DNS reputation enforcement from the FTD CLI is not recommended as it could cause system instability. The fixed releases include FTD Software versions 7.0.2 (May 2022) and 7.1.0.1 (Cisco Advisory).