CVE-2023-20246: 
Snort vulnerability analysis and mitigation

Multiple Cisco products are affected by a vulnerability in Snort access control policies that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. The vulnerability (CVE-2023-20246) was discovered during the resolution of a Cisco TAC support case and was publicly disclosed on November 1, 2023. The affected products include Open Source Snort 3, Cisco FirePOWER and Firepower Threat Defense Software running Snort 3, and certain Cisco IOS XE Products with UTD enabled (Cisco Advisory).

The vulnerability stems from a logic error that occurs when the access control policies are being populated. It has been assigned a CVSS Base Score of 5.8 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) and is classified under CWE-290 (Authentication Bypass by Spoofing). The vulnerability specifically affects systems running Snort 3, with versions prior to 3.1.57.0 being vulnerable (NVD, Cisco Advisory).

A successful exploitation of this vulnerability could allow an attacker to bypass configured access control rules on the affected system. This means unauthorized traffic that should be blocked by the security policies could potentially flow through the device, compromising the intended security posture (Cisco Advisory).

The vulnerability can be exploited by an unauthenticated, remote attacker by establishing a connection to an affected device. The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of this vulnerability at the time of disclosure (Cisco Advisory).

Cisco has released software updates that address this vulnerability. For Open Source Snort, version 3.1.57.0 contains the fix. For Cisco FTD Software and other affected products, specific version updates are available. There are no workarounds that address this vulnerability. For cloud-based Cisco Umbrella Secure Internet Gateway (SIG), Cisco has addressed the vulnerability and no user action is required (Cisco Advisory).