Missing Report of Error Condition in Suricata - #VU162654
Published: November 9, 2026
Vulnerability identifier: #VU162654
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-392
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to bypass Suricata rules that depend on affected DNP3 decoder events.
The vulnerability exists due to the DNP3 parser discarding link-layer anomaly events occurring before the first transaction when DNP3 parsing is enabled, a non-default configuration. An unauthenticated remote attacker can send crafted traffic containing such an anomaly to prevent the corresponding event from being reported.
Affected software
Suricata
Remediation
Install security update from vendor's website.
Suricata - update to 8.0.7