Cisco Cyber Vision Snort 3 Detection Engine error condition

Summaryinfo

A vulnerability has been found in Cisco Cyber Vision, Secure Firewall Threat Defense Software and UTD SNORT IPS Engine Software and classified as problematic. This affects an unknown part of the component Snort 3 Detection Engine. This manipulation causes error condition. This vulnerability is tracked as CVE-2026-20005. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Cisco Cyber Vision, Secure Firewall Threat Defense Software and UTD SNORT IPS Engine Software (the affected version unknown). It has been declared as problematic. Affected by this vulnerability is an unknown part of the component Snort 3 Detection Engine. The manipulation with an unknown input leads to a error condition vulnerability. The CWE definition for the vulnerability is CWE-392. The product encounters an error but does not provide a status code or return value to indicate that an error has occurred. As an impact it is known to affect availability. The summary by CVE is:

Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulnerability is due to incomplete parsing of the SSL handshake ingress packets. An attacker could exploit this vulnerability by sending crafted SSL handshake packets. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when the Snort 3 Detection Engine restarts unexpectedly.

The advisory is shared at sec.cloudapps.cisco.com. This vulnerability is known as CVE-2026-20005 since 10/08/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/05/2026).

Upgrading eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• Cyber Vision
• Secure Firewall Threat Defense Software
• UTD SNORT IPS Engine Software

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion