Multiple Cisco Products Snort Application Detection Engine Policy Bypass Vulnerability
Priority LOW 28CWE-670Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Multiple Cisco products are affected by a vulnerability in the Snort application detection engine that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. The vulnerability is due to a flaw in the detection algorithm. An attacker could exploit this vulnerability by sending crafted packets that would flow through an affected system. A successful exploit could allow the attacker to bypass the configured policies and deliver a malicious payload to the protected network.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02191 82nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco Firepower Threat Defense Software | all versions | — | No fix listed | CNA |
- Cisco Firepower Threat Defense Software VendorCisco Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 23
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:* | before 17.4.1 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:1109-2p_integrated_services_router:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:1109-4p_integrated_services_router:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:1111x-8p_integrated_services_router:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:4221_integrated_services_router:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:4321_integrated_services_router:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:4331_integrated_services_router:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
- cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:* Versions before 17.4.1 Vulnerable ·Cisco
- cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:1109-2p_integrated_services_router:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:1109-4p_integrated_services_router:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:1111x-8p_integrated_services_router:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:4221_integrated_services_router:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:4321_integrated_services_router:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:4331_integrated_services_router:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Show 13 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:cisco:4351_integrated_services_router:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:4431_integrated_services_router:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:4451-x_integrated_services_router:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:4461_integrated_services_router:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:csr_1000v:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:isa_3000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:a:cisco:secure_firewall_management_center:2.9.14.0:*:*:*:*:*:*:* | 2.9.14.0 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_firewall_management_center:2.9.14.14:*:*:*:*:*:*:* | 2.9.14.14 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_firewall_management_center:2.9.15:*:*:*:*:*:*:* | 2.9.15 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_firewall_management_center:2.9.16:*:*:*:*:*:*:* | 2.9.16 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_firewall_management_center:2.9.17:*:*:*:*:*:*:* | 2.9.17 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:* | before 6.5.0.5 | Vulnerable | Cisco |
| cpe:2.3:a:snort:snort:*:*:*:*:*:*:*:* | before 2.9.14 | Vulnerable | Snort |
- cpe:2.3:h:cisco:4351_integrated_services_router:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:4431_integrated_services_router:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:4451-x_integrated_services_router:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:4461_integrated_services_router:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:csr_1000v:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:isa_3000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:a:cisco:secure_firewall_management_center:2.9.14.0:*:*:*:*:*:*:* Versions 2.9.14.0 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_firewall_management_center:2.9.14.14:*:*:*:*:*:*:* Versions 2.9.14.14 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_firewall_management_center:2.9.15:*:*:*:*:*:*:* Versions 2.9.15 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_firewall_management_center:2.9.16:*:*:*:*:*:*:* Versions 2.9.16 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_firewall_management_center:2.9.17:*:*:*:*:*:*:* Versions 2.9.17 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:* Versions before 6.5.0.5 Vulnerable ·Cisco
- cpe:2.3:a:snort:snort:*:*:*:*:*:*:*:* Versions before 2.9.14 Vulnerable ·Snort
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-1236
- 2026-10-03 Alias added: GHSA-hj38-j9jq-rjpp
References
More Cisco Ios Xe vulnerabilities
- TI-2023-06904 Cisco is providing an update for the ongoing investigation into observed exploitation of… KEVCVSS 3.1CRITICAL 10.0
- TI-2018-00122 Memory corruption in Cisco IOS and IOS XE KEVCVSS 3.1CRITICAL 9.8
- TI-2017-02977 Improper input validation in Cisco IOS and IOS XE Software KEVCVSS 3.1CRITICAL 9.8
- TI-2018-00135 Memory corruption in Cisco IOS, IOS XE, and IOS XR KEVCVSS 3.1HIGH 8.8
- TI-2017-04498 Memory corruption in Cisco IOS KEVCVSS 3.1HIGH 8.8
- TI-2017-04497 Memory corruption in Cisco IOS XE Software KEVCVSS 3.1HIGH 8.8
Sources
- CVE-2021-1236 · CVE Program
- CVE-2021-1236 · NVD
- FIRST EPSS
- GHSA-hj38-j9jq-rjpp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences