Read the docs
TI-2024-13432 Aliases CVE-2024-20508GHSA-fmxj-97w3-xq3m

Cisco UTD Snort IPS Engine Software for Cisco IOS XE Software Security Policy Bypass and Denial of Service Vulnerability

Priority LOW 35CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A vulnerability in Cisco Unified Threat Defense (UTD) Snort Intrusion Prevention System (IPS) Engine for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass configured security policies or cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient validation of HTTP requests when they are processed by Cisco UTD Snort IPS Engine. An attacker could exploit this vulnerability by sending a crafted HTTP request through an affected device. A successful exploit could allow the attacker to trigger a reload of the Snort process. If the action in case of Cisco UTD Snort IPS Engine failure is set to the default, fail-open, successful exploitation of this vulnerability could allow the attacker to bypass configured security policies. If the action in case of Cisco UTD Snort IPS Engine failure is set to fail-close, successful exploitation of this vulnerability could cause traffic that is configured to be inspected by Cisco UTD Snort IPS Engine to be dropped.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00417 36th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco UTD SNORT IPS Engine Software17.12.1a; 17.12.2; 17.13.1a; 17.12.3; 17.12.3a; 17.15.1a; 17.9.5a; 17.6.1a; 17.8.1a; 17.6.2; 17.7.2; 17.12.4; 17.14.1a; 17.11.1a; 17.7.1a; 17.6.6—No fix listedCNA
  • Cisco UTD SNORT IPS Engine Software VendorCisco Affected 17.12.1a; 17.12.2; 17.13.1a; 17.12.3; 17.12.3a; 17.15.1a; 17.9.5a; 17.6.1a; 17.8.1a; 17.6.2; 17.7.2; 17.12.4; 17.14.1a; 17.11.1a; 17.7.1a; 17.6.6 Fixed in — No fix listed CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.6.1a:*:*:*:*:*:*:*17.6.1aVulnerableCisco
cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.6.2:*:*:*:*:*:*:*17.6.2VulnerableCisco
cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.6.6:*:*:*:*:*:*:*17.6.6VulnerableCisco
cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.7.1a:*:*:*:*:*:*:*17.7.1aVulnerableCisco
cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.7.2:*:*:*:*:*:*:*17.7.2VulnerableCisco
cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.8.1a:*:*:*:*:*:*:*17.8.1aVulnerableCisco
cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.9.5a:*:*:*:*:*:*:*17.9.5aVulnerableCisco
cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.11.1a:*:*:*:*:*:*:*17.11.1aVulnerableCisco
cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.1a:*:*:*:*:*:*:*17.12.1aVulnerableCisco
cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.2:*:*:*:*:*:*:*17.12.2VulnerableCisco
  • cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.6.1a:*:*:*:*:*:*:* Versions 17.6.1a Vulnerable ·Cisco
  • cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.6.2:*:*:*:*:*:*:* Versions 17.6.2 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.6.6:*:*:*:*:*:*:* Versions 17.6.6 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.7.1a:*:*:*:*:*:*:* Versions 17.7.1a Vulnerable ·Cisco
  • cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.7.2:*:*:*:*:*:*:* Versions 17.7.2 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.8.1a:*:*:*:*:*:*:* Versions 17.8.1a Vulnerable ·Cisco
  • cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.9.5a:*:*:*:*:*:*:* Versions 17.9.5a Vulnerable ·Cisco
  • cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.11.1a:*:*:*:*:*:*:* Versions 17.11.1a Vulnerable ·Cisco
  • cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.1a:*:*:*:*:*:*:* Versions 17.12.1a Vulnerable ·Cisco
  • cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.2:*:*:*:*:*:*:* Versions 17.12.2 Vulnerable ·Cisco
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.3:*:*:*:*:*:*:*17.12.3VulnerableCisco
cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.3a:*:*:*:*:*:*:*17.12.3aVulnerableCisco
cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.4:*:*:*:*:*:*:*17.12.4VulnerableCisco
cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.13.1a:*:*:*:*:*:*:*17.13.1aVulnerableCisco
cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.14.1a:*:*:*:*:*:*:*17.14.1aVulnerableCisco
cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.15.1a:*:*:*:*:*:*:*17.15.1aVulnerableCisco
  • cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.3:*:*:*:*:*:*:* Versions 17.12.3 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.3a:*:*:*:*:*:*:* Versions 17.12.3a Vulnerable ·Cisco
  • cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.4:*:*:*:*:*:*:* Versions 17.12.4 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.13.1a:*:*:*:*:*:*:* Versions 17.13.1a Vulnerable ·Cisco
  • cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.14.1a:*:*:*:*:*:*:* Versions 17.14.1a Vulnerable ·Cisco
  • cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.15.1a:*:*:*:*:*:*:* Versions 17.15.1a Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-20508
  2. 2026-10-03 Alias added: GHSA-fmxj-97w3-xq3m

References

Advisory 1

  • TI-2022-05244 Multiple Cisco Products Snort Modbus Denial of Service Vulnerability CVSS 3.1HIGH 7.5
  • TI-2026-16281 Multiple Cisco Products Snort 3 TBD Denial of Service Vulnerability CVSS 3.1MEDIUM 5.8
  • TI-2026-16280 Multiple Cisco Products Snort 3 TBD Denial of Service Vulnerability CVSS 3.1MEDIUM 5.8
  • TI-2026-16271 Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Denial of Service Vulnerability CVSS 3.1MEDIUM 5.8
  • TI-2026-16268 Infinite loop in Cisco Cyber Vision CVSS 3.1MEDIUM 5.8
  • TI-2026-16224 Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine… CVSS 3.1MEDIUM 5.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences