CVE-2022-20950: cisco cisco firepower threat defense software

Vulnerability summary

CVE-2022-20950 is a medium (CVSS 5.8) vulnerability in cisco cisco firepower threat defense software. EPSS estimates a 0.88% chance of exploitation in the next 30 days, higher than 58.2% of scored vulnerabilities.

Timeline

1. 10-11-2022
   PublishedVulnerability first disclosed.
2. 19-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the interaction of SIP and Snort 3 for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to restart. This vulnerability is due to a lack of error-checking when SIP bidirectional flows are being inspected by Snort 3. An attacker could exploit this vulnerability by sending a stream of crafted SIP traffic through an interface on the targeted device. A successful exploit could allow the attacker to trigger a restart of the Snort 3 process, resulting in a denial of service (DoS) condition.

• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
• CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.