Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Medium | n/a | cisco-sa-snort3-mime-vulns-bkXjcKkt |
Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability
CiscoCisco Snort 3, Cisco Secure Firewall Threat Defense Software, Cisco UTD Snort IPS Engine for Cisco IOS XE Software, Cisco UTD Engine for Cisco IOS XE SD-WAN Software, Cisco 1000 Series Integrated Services Routers, Cisco 8100 Series Secure Routers, Cisco 8200 Series Secure Routers, Cisco 8300 Series Secure Routers, Cisco 8400 Series Secure Routers, Cisco Catalyst 8000V Edge Software, Cisco Catalyst 8200 Series Edge Platforms, Cisco Catalyst 8300 Series Edge Platforms, Cisco Catalyst 8500L Edge Platforms, Cisco Catalyst IR1800 Rugged Series Routers, Cisco Catalyst IR8340 Rugged Routers, Cisco Cloud Services Routers 1000V, Cisco Integrated Services Virtual Routers, Cisco Meraki MX Security Appliances
|
Cisco PSIRT | |||
|
cisco-sa-snort3-mime-vulns-bkXjcKktCVE-2026-20011Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability
Executive summaryMultiple Cisco products are affected by a Snort 3 SMTP MIME vulnerability that an unauthenticated remote attacker could use to make the Snort 3 Detection Engine restart, causing a denial of service. The advisory rates it Medium with a base CVSS score of 5.8, and Cisco has released software updates to fix it; no workarounds are available. Affected products include Open Source Snort 3, Cisco Secure Firewall Threat Defense software when Snort 3 is configured, and certain Cisco IOS XE and Meraki MX devices running vulnerable UTD or Meraki releases. Technical summaryThe flaw is a lack of error checking when MIME fields of SMTP headers are parsed by the Snort 3 SMTP MIME Decoder, which is a denial of service issue (CWE-805, CVE-2026-20011). An unauthenticated remote attacker can exploit it by sending crafted SMTP packets over an established connection, and Snort 3 must be active on Cisco Secure FTD for exploitation. The advisory lists fixed Open Source Snort 3 release 3.10.1.0 and 3.12.4.0, and fixed UTD on Cisco IOS XE releases 17.12.8, 17.15.6, 17.18.5, 26.1.2, and 26.2.1; fixed Cisco Secure FTD and Meraki versions are not stated in the text beyond the Software Checker reference. No workarounds exist, and the advisory gives no specific detection guidance beyond checking whether Snort 3 or UTD is active using the listed show command. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Cisco 4000 Series Integrated Services Routers Summarized from sec.cloudapps.cisco.com/security/center…-mime-vulns-bkXjcKkt ScoreNo CVSS score published. AffectsCiscoCisco Snort 3Cisco Secure Firewall Threat Defense SoftwareCisco UTD Snort IPS Engine for Cisco IOS XE SoftwareCisco UTD Engine for Cisco IOS XE SD-WAN SoftwareCisco 1000 Series Integrated Services RoutersCisco 8100 Series Secure RoutersCisco 8200 Series Secure RoutersCisco 8300 Series Secure RoutersCisco 8400 Series Secure RoutersCisco Catalyst 8000V Edge SoftwareCisco Catalyst 8200 Series Edge PlatformsCisco Catalyst 8300 Series Edge PlatformsCisco Catalyst 8500L Edge PlatformsCisco Catalyst IR1800 Rugged Series RoutersCisco Catalyst IR8340 Rugged RoutersCisco Cloud Services Routers 1000VCisco Integrated Services Virtual RoutersCisco Meraki MX Security Appliances
Cisco Product Security Incident Response TeamPublished
Read the advisory
|
|||||||
| Medium | n/a | cisco-sa-snort3-vba-bufdos-jAuFdvn9 |
Multiple Cisco Products Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability
Cisco, SnortCisco Open Source Snort3, Cisco Secure Firewall Threat Defense Software, Cisco UTD Snort IPS Engine for Cisco IOS XE Software, Cisco UTD Engine for Cisco IOS XE SD-WAN Software, Cisco 8100 Series Secure Routers, Cisco 8200 Series Secure Routers, Cisco 8300 Series Secure Routers, Cisco 8400 Series Secure Routers, Cisco Catalyst 8000V Edge Software, Cisco Catalyst 8200 Series Edge Platforms, Cisco Catalyst 8300 Series Edge Platforms, Cisco Catalyst 8500L Edge Platforms, Cisco Catalyst IR1800 Rugged Series Routers, Cisco Catalyst IR8340 Rugged Routers, Cisco Cloud Services Routers 1000V, Cisco Integrated Services Virtual Routers, Snort, Cisco 1000 Series Integrated Services Routers (ISRs), Cisco 4000 Series ISRs
|
Cisco PSIRT | |||
|
cisco-sa-snort3-vba-bufdos-jAuFdvn9CVE-2026-20218Multiple Cisco Products Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability
Executive summaryA flaw in the Snort 3 Visual Basic for Applications decompression engine affects Open Source Snort 3, Cisco Secure Firewall Threat Defense software when Snort 3 and VBA decompression are configured, and Unified Threat Defense on several Cisco IOS XE routers and gateways. An unauthenticated remote attacker can crash the Snort 3 detection engine by sending crafted VBA data, causing denial of service. Cisco rates the advisory Medium with a CVSS base score of 5.8, and recommends upgrading to a fixed release, with a workaround of disabling VBA decompression available until then. Technical summaryThe vulnerability is a buffer overflow (CWE-121) caused by improper range checking when Snort 3 decompresses user-controlled VBA data, and it can be triggered by an unauthenticated remote attacker sending crafted VBA data to a targeted device. A successful exploit causes a stack data overflow that restarts the Snort 3 Detection Engine, resulting in denial of service. Exploitation requires Snort 3 to be active, and for Secure FTD, at least one Snort 3 detector configured for VBA macro decompression, which is not enabled by default and applies to IMAP, SMTP, HTTP, and POP3 inspectors. Fixed releases are stated as Open Source Snort 3.12.4.0 and, for UTD on IOS XE, 17.12.8, 17.15.6, 17.18.5, 26.1.2, and 26.2.1; no fixed Secure FTD release is stated in the advisory, which directs users to the Cisco Software Checker. The workaround is to disable VBA decompression, and the advisory does not state any detection guidance beyond checking the Snort version and UTD status commands. Cisco reports no known public announcements or malicious use, and the CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L/E:X/RL:X/RC:X. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from sec.cloudapps.cisco.com/security/center…-vba-bufdos-jAuFdvn9 ScoreNo CVSS score published. AffectsCiscoSnortCisco Open Source Snort3Cisco Secure Firewall Threat Defense SoftwareCisco UTD Snort IPS Engine for Cisco IOS XE SoftwareCisco UTD Engine for Cisco IOS XE SD-WAN SoftwareCisco 8100 Series Secure RoutersCisco 8200 Series Secure RoutersCisco 8300 Series Secure RoutersCisco 8400 Series Secure RoutersCisco Catalyst 8000V Edge SoftwareCisco Catalyst 8200 Series Edge PlatformsCisco Catalyst 8300 Series Edge PlatformsCisco Catalyst 8500L Edge PlatformsCisco Catalyst IR1800 Rugged Series RoutersCisco Catalyst IR8340 Rugged RoutersCisco Cloud Services Routers 1000VCisco Integrated Services Virtual RoutersSnortCisco 1000 Series Integrated Services Routers (ISRs)Cisco 4000 Series ISRs
Cisco Product Security Incident Response TeamPublished
Read the advisory
|
|||||||