Cisco Cyber Vision Modbus Preprocessor integer overflow

Summaryinfo

A vulnerability was found in Cisco Cyber Vision, Firepower Threat Defense Software and UTD SNORT IPS Engine Software and classified as critical. Affected by this issue is some unknown functionality of the component Modbus Preprocessor. The manipulation results in integer overflow. This vulnerability is identified as CVE-2022-20685. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Cisco Cyber Vision, Firepower Threat Defense Software and UTD SNORT IPS Engine Software (the affected version is unknown). Affected is an unknown code of the component Modbus Preprocessor. The manipulation with an unknown input leads to a integer overflow vulnerability. CWE is classifying the issue as CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. This is going to have an impact on availability. CVE summarizes:

A vulnerability in the Modbus preprocessor of the Snort detection engine could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an integer overflow while processing Modbus traffic. An attacker could exploit this vulnerability by sending crafted Modbus traffic through an affected device. A successful exploit could allow the attacker to cause the Snort process to hang, causing traffic inspection to stop.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

The advisory is shared for download at sec.cloudapps.cisco.com. This vulnerability is traded as CVE-2022-20685 since 11/02/2021. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/03/2025).

The vulnerability scanner Nessus provides a plugin with the ID 241194 (Cisco Meraki 14 / 15 / 16 < 16.16 DoS (cisco-sa-snort-dos-9D3hJLuj)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (241194). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• Cyber Vision
• Firepower Threat Defense Software
• UTD SNORT IPS Engine Software

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion