CVE-2024-20363: 
Snort vulnerability analysis and mitigation

Multiple Cisco products are affected by a vulnerability (CVE-2024-20363) in the Snort Intrusion Prevention System (IPS) rule engine that could allow an unauthenticated, remote attacker to bypass the configured rules on affected systems. The vulnerability was discovered during internal security testing and was publicly disclosed on May 22, 2024. The affected products include Open Source Snort 3, Cisco FirePOWER Services, Firepower Threat Defense (FTD) Software, and various Cisco IOS XE Software products running vulnerable releases of Unified Threat Defense (UTD) Snort IPS Engine (Cisco Advisory).

The vulnerability stems from incorrect HTTP packet handling in the Snort IPS rule engine. It has been assigned a CVSS v3.1 base score of 5.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N. The vulnerability is classified as CWE-290 (Authentication Bypass by Spoofing) (NVD, Cisco Advisory).

A successful exploitation of this vulnerability could allow an attacker to bypass configured IPS rules and permit uninspected traffic onto the network. This could potentially compromise the security posture of affected systems by circumventing intended security controls (Cisco Advisory).

The vulnerability can be exploited by an unauthenticated, remote attacker by sending crafted HTTP packets through an affected device. As of the disclosure date, Cisco PSIRT is not aware of any public announcements or malicious use of this vulnerability in the wild (Cisco Advisory).

Cisco has released software updates that address this vulnerability. For Open Source Snort, version 3.1.69.0 contains the fix. There are no workarounds available for this vulnerability. Organizations using affected products should upgrade to the fixed versions as soon as possible (Cisco Advisory).