Authentication Bypass by Spoofing in Cisco Systems, Inc products - CVE-2024-20363

Vulnerability identifier: #VU89834

CSH Severity: Medium

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2024-20363

CWE-ID: CWE-290

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
Cisco IOS XE
FirePOWER Services
Cisco Firewall Threat Defense (FTD)
Cisco 1000 Series Integrated Services Routers
4000 Series Integrated Services Routers
Catalyst 8000V Edge Software
Catalyst 8200 Series Edge Platforms
Catalyst 8300 Series Edge Platforms
Catalyst 8500L Series Edge Platforms
Cloud Services Routers 1000V Series
Integrated Services Virtual Router
Open Source Snort 3

Software vendor:
Cisco Systems, Inc

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to incorrect HTTP packet handling. A remote attacker can send specially crafted HTTP packets, bypass configured IPS rules and allow uninspected traffic onto the network.

Install updates from vendor's website.

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-ips-bypass-uE69KBMd