Read the docs
TI-2023-06779 Aliases CVE-2023-20071GHSA-54ph-4xc5-8pjx

Multiple Cisco products are affected by a vulnerability in the Snort detection engine…

Priority LOW 27CWE-1039Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. This vulnerability is due to a flaw in the FTP module of the Snort detection engine. An attacker could exploit this vulnerability by sending crafted FTP traffic through an affected device. A successful exploit could allow the attacker to bypass FTP inspection and deliver a malicious payload.

Why it matters now

EPSS 0.00684 52nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Firepower Threat Defense Software6.2.3; 6.2.3.1; 6.2.3.2; 6.2.3.3; 6.2.3.4; 6.2.3.5; 6.2.3.6; 6.2.3.7; 6.2.3.8; 6.2.3.10; 6.2.3.11; 6.2.3.9; 6.2.3.12; 6.2.3.13; 6.2.3.14; 6.2.3.15; 6.2.3.16; 6.2.3.17; 6.2.3.18; 6.6.0; 6.6.0.1; 6.6.1; 6.6.3; 6.6.4; 6.6.5; 6.6.5.1; 6.6.5.2; 6.6.7; 6.6.7.1; 6.4.0; 6.4.0.1; 6.4.0.3; 6.4.0.2; 6.4.0.4; 6.4.0.5; 6.4.0.6; 6.4.0.7; 6.4.0.8; 6.4.0.9; 6.4.0.10; 6.4.0.11; 6.4.0.12; 6.4.0.13; 6.4.0.14; 6.4.0.15; 6.4.0.16; 6.7.0; 6.7.0.1; 6.7.0.2; 6.7.0.3; 7.0.0; 7.0.0.1; 7.0.1; 7.0.1.1; 7.0.2; 7.0.2.1; 7.0.3; 7.0.4; 7.0.5; 7.1.0; 7.1.0.1; 7.1.0.2; 7.1.0.3; 7.2.0; 7.2.0.1; 7.2.1; 7.2.2; 7.2.3; 7.3.0; 7.3.1; 7.3.1.1—No fix listedCNA
CiscoCisco Umbrella Insights Virtual ApplianceN/A—No fix listedCNA
CiscoCisco Cyber Vision3.0.4; 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.5; 3.0.6; 3.1.0; 3.1.2; 3.1.1; 3.2.3; 3.2.1; 3.2.4; 3.2.0; 3.2.2; 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.1.0; 4.1.1; 4.1.2—No fix listedCNA
CiscoCisco UTD SNORT IPS Engine Software16.12.1a; 16.12.2; 16.12.3; 16.12.4; 16.12.5; 16.12.6; 16.12.7; 16.12.8; 16.6.1; 16.6.5; 16.6.6; 16.6.7a; 16.6.9; 16.6.10; 17.1.1; 17.2.1r; 17.3.1a; 17.3.2; 17.3.3; 17.3.4a; 17.3.6; 17.3.5; 17.3.7; 3.17.0S; 3.17.1S; 17.4.1a; 17.4.2; 17.4.1b; 17.5.1a; 17.6.1a; 17.6.2; 17.6.3a; 17.6.4; 17.6.5; 17.7.1a; 17.7.2; 17.10.1a; 17.9.1a; 17.9.2a; 17.9.3a; 17.8.1a; Fuji-16.9.2; Fuji-16.9.4; Fuji-16.9.6; Fuji-16.9.3; Fuji-16.9.7; Fuji-16.9.8; Fuji-16.9.5; Denali-16.3.3; Denali-16.3.9; Denali-16.3.7; Denali-16.3.5; Denali-16.3.4; Everest-16.6.3; Everest-16.6.4; Everest-16.6.2—No fix listedCNA
  • Cisco Firepower Threat Defense Software VendorCisco Affected 6.2.3; 6.2.3.1; 6.2.3.2; 6.2.3.3; 6.2.3.4; 6.2.3.5; 6.2.3.6; 6.2.3.7; 6.2.3.8; 6.2.3.10; 6.2.3.11; 6.2.3.9; 6.2.3.12; 6.2.3.13; 6.2.3.14; 6.2.3.15; 6.2.3.16; 6.2.3.17; 6.2.3.18; 6.6.0; 6.6.0.1; 6.6.1; 6.6.3; 6.6.4; 6.6.5; 6.6.5.1; 6.6.5.2; 6.6.7; 6.6.7.1; 6.4.0; 6.4.0.1; 6.4.0.3; 6.4.0.2; 6.4.0.4; 6.4.0.5; 6.4.0.6; 6.4.0.7; 6.4.0.8; 6.4.0.9; 6.4.0.10; 6.4.0.11; 6.4.0.12; 6.4.0.13; 6.4.0.14; 6.4.0.15; 6.4.0.16; 6.7.0; 6.7.0.1; 6.7.0.2; 6.7.0.3; 7.0.0; 7.0.0.1; 7.0.1; 7.0.1.1; 7.0.2; 7.0.2.1; 7.0.3; 7.0.4; 7.0.5; 7.1.0; 7.1.0.1; 7.1.0.2; 7.1.0.3; 7.2.0; 7.2.0.1; 7.2.1; 7.2.2; 7.2.3; 7.3.0; 7.3.1; 7.3.1.1 Fixed in — No fix listed CNA
  • Cisco Umbrella Insights Virtual Appliance VendorCisco Affected N/A Fixed in — No fix listed CNA
  • Cisco Cyber Vision VendorCisco Affected 3.0.4; 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.5; 3.0.6; 3.1.0; 3.1.2; 3.1.1; 3.2.3; 3.2.1; 3.2.4; 3.2.0; 3.2.2; 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.1.0; 4.1.1; 4.1.2 Fixed in — No fix listed CNA
  • Cisco UTD SNORT IPS Engine Software VendorCisco Affected 16.12.1a; 16.12.2; 16.12.3; 16.12.4; 16.12.5; 16.12.6; 16.12.7; 16.12.8; 16.6.1; 16.6.5; 16.6.6; 16.6.7a; 16.6.9; 16.6.10; 17.1.1; 17.2.1r; 17.3.1a; 17.3.2; 17.3.3; 17.3.4a; 17.3.6; 17.3.5; 17.3.7; 3.17.0S; 3.17.1S; 17.4.1a; 17.4.2; 17.4.1b; 17.5.1a; 17.6.1a; 17.6.2; 17.6.3a; 17.6.4; 17.6.5; 17.7.1a; 17.7.2; 17.10.1a; 17.9.1a; 17.9.2a; 17.9.3a; 17.8.1a; Fuji-16.9.2; Fuji-16.9.4; Fuji-16.9.6; Fuji-16.9.3; Fuji-16.9.7; Fuji-16.9.8; Fuji-16.9.5; Denali-16.3.3; Denali-16.3.9; Denali-16.3.7; Denali-16.3.5; Denali-16.3.4; Everest-16.6.3; Everest-16.6.4; Everest-16.6.2 Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*before 6.4.0.17; 6.5.0 to before 7.0.6; 7.1.0 to before 7.2.4; 7.3.0 to before 7.3.1.2VulnerableCisco
cpe:2.3:a:snort:snort:2.0:-:*:*:*:*:*:*2.0Running onSnort
cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*6.7.0 to before 7.0.5; 7.1.0 to before 7.1.0.3; 7.2.0 to before 7.2.1VulnerableCisco
cpe:2.3:a:snort:snort:*:*:*:*:*:*:*:*before 3.1.32.0Running onSnort
cpe:2.3:a:cisco:cyber_vision:*:*:*:*:*:*:*:*before 4.1.3VulnerableCisco
cpe:2.3:a:cisco:unified_threat_defense:*:*:*:*:*:*:*:*17.3 to before 17.3.8; 17.6 to before 17.6.6; 17.9 to before 17.9.4; 17.11 to before 17.11.1a; 17.12 to before 17.12.1aVulnerableCisco
cpe:2.3:o:cisco:meraki_mx_security_appliance_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:* Versions before 6.4.0.17; 6.5.0 to before 7.0.6; 7.1.0 to before 7.2.4; 7.3.0 to before 7.3.1.2 Vulnerable ·Cisco
  • cpe:2.3:a:snort:snort:2.0:-:*:*:*:*:*:* Versions 2.0 Running on ·Snort
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:* Versions 6.7.0 to before 7.0.5; 7.1.0 to before 7.1.0.3; 7.2.0 to before 7.2.1 Vulnerable ·Cisco
  • cpe:2.3:a:snort:snort:*:*:*:*:*:*:*:* Versions before 3.1.32.0 Running on ·Snort
  • cpe:2.3:a:cisco:cyber_vision:*:*:*:*:*:*:*:* Versions before 4.1.3 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_threat_defense:*:*:*:*:*:*:*:* Versions 17.3 to before 17.3.8; 17.6 to before 17.6.6; 17.9 to before 17.9.4; 17.11 to before 17.11.1a; 17.12 to before 17.12.1a Vulnerable ·Cisco
  • cpe:2.3:o:cisco:meraki_mx_security_appliance_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-20071
  2. 2026-10-03 Alias added: GHSA-54ph-4xc5-8pjx
  3. 2026-11-02 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
  • TI-2022-05244 Multiple Cisco Products Snort Modbus Denial of Service Vulnerability CVSS 3.1HIGH 7.5
  • TI-2026-16281 Multiple Cisco Products Snort 3 TBD Denial of Service Vulnerability CVSS 3.1MEDIUM 5.8
  • TI-2026-16271 Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Denial of Service Vulnerability CVSS 3.1MEDIUM 5.8
  • TI-2026-16268 Infinite loop in Cisco Cyber Vision CVSS 3.1MEDIUM 5.8
  • TI-2026-16224 Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine… CVSS 3.1MEDIUM 5.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences