CVE-2024-20363: Medium severity Cisco Firepower Threat Defense vulnerability
Multiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that could allow an unauthenticated, remote attacker to bypass the configured rules on an affected system. This vulnerability is due to incorrect HTTP packet handling. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass configured IPS rules and allow uninspected traffic onto the network.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-20363?
CVE-2024-20363 is rated as a medium severity vulnerability that allows attackers to bypass configured intrusion prevention system rules.
How do I fix CVE-2024-20363?
To mitigate CVE-2024-20363, it is recommended to update affected Cisco products to their latest versions that address this vulnerability.
What types of Cisco products are affected by CVE-2024-20363?
CVE-2024-20363 affects Cisco Firepower Threat Defense and several versions of Cisco Unified Threat Defense Snort Intrusion Prevention System Engine.
Can CVE-2024-20363 be exploited remotely?
Yes, CVE-2024-20363 can be exploited by an unauthenticated remote attacker who can send crafted HTTP packets.
What causes the vulnerability described in CVE-2024-20363?
The vulnerability in CVE-2024-20363 is due to incorrect handling of HTTP packets by the Snort IPS rule engine.