CVE-2024-20508: Cisco UTD Snort IPS Engine Software for Cisco IOS XE Software Security Policy Bypass and Denial of Service Vulnerability

Published Sep 25, 2024

Updated

A vulnerability in Cisco Unified Threat Defense (UTD) Snort Intrusion Prevention System (IPS) Engine for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass configured security policies or cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient validation of HTTP requests when they are processed by Cisco UTD Snort IPS Engine. An attacker could exploit this vulnerability by sending a crafted HTTP request through an affected device. A successful exploit could allow the attacker to trigger a reload of the Snort process. If the action in case of Cisco UTD Snort IPS Engine failure is set to the default, fail-open, successful exploitation of this vulnerability could allow the attacker to bypass configured security policies. If the action in case of Cisco UTD Snort IPS Engine failure is set to fail-close, successful exploitation of this vulnerability could cause traffic that is configured to be inspected by Cisco UTD Snort IPS Engine to be dropped.

Affected Software

16 affected components

Cisco Unified Threat Defense Snort Intrusion Prevention System Engine=17.6.1a

Cisco Unified Threat Defense Snort Intrusion Prevention System Engine=17.6.2

Cisco Unified Threat Defense Snort Intrusion Prevention System Engine=17.6.6

Cisco Unified Threat Defense Snort Intrusion Prevention System Engine=17.7.1a

Cisco Unified Threat Defense Snort Intrusion Prevention System Engine=17.7.2

Cisco Unified Threat Defense Snort Intrusion Prevention System Engine=17.8.1a

Cisco Unified Threat Defense Snort Intrusion Prevention System Engine=17.9.5a

Cisco Unified Threat Defense Snort Intrusion Prevention System Engine=17.11.1a

Cisco Unified Threat Defense Snort Intrusion Prevention System Engine=17.12.1a

Cisco Unified Threat Defense Snort Intrusion Prevention System Engine=17.12.2

Cisco Unified Threat Defense Snort Intrusion Prevention System Engine=17.12.3

Cisco Unified Threat Defense Snort Intrusion Prevention System Engine=17.12.3a

Cisco Unified Threat Defense Snort Intrusion Prevention System Engine=17.12.4

Cisco Unified Threat Defense Snort Intrusion Prevention System Engine=17.13.1a

Cisco Unified Threat Defense Snort Intrusion Prevention System Engine=17.14.1a

Cisco Unified Threat Defense Snort Intrusion Prevention System Engine=17.15.1a

Event History

Sep 25, 2024

CVE Published

via MITRE·04:19 PM

Data Sourced

via MITRE·04:19 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-20508?

The severity of CVE-2024-20508 is classified as high due to its potential to allow unauthorized access and service disruption.

How do I fix CVE-2024-20508?

To fix CVE-2024-20508, upgrade the Cisco Unified Threat Defense Snort IPS Engine to a patched version as recommended by Cisco.

What are the affected versions for CVE-2024-20508?

CVE-2024-20508 affects multiple versions of the Cisco Unified Threat Defense Snort IPS Engine, including 17.6.1a, 17.6.2, 17.7.1a, and more.

Can CVE-2024-20508 be exploited remotely?

Yes, CVE-2024-20508 can be exploited by unauthenticated remote attackers.

What impact can CVE-2024-20508 have on my network devices?

CVE-2024-20508 can allow attackers to bypass security policies or cause a denial of service condition on affected devices.