CVE-2026-20290: Cisco Secure Firewall Threat Defense Software Snort 2 SSL/TLS Denial of Service Vulnerability
A vulnerability in SSL/TLS certificate parsing in the Snort 2 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 2 Detection Engine to restart. This vulnerability is due to incomplete validation of the SSL certificate. An attacker could exploit this vulnerability by sending a crafted SSL connection setup request to be parsed by Snort 2. A successful exploit could allow the attacker to cause the Snort 2 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker does not need authentication or user interaction. They need to send a crafted SSL connection setup request that is parsed by the Snort 2 Detection Engine.
Does this vulnerability expose or alter data?
The provided CVSS vector indicates no confidentiality or integrity impact. The impact is limited to availability, because successful exploitation can restart the Snort 2 Detection Engine.
Which deployments can be identified as potentially affected from the available information?
The issue applies to Cisco Secure Firewall Threat Defense Software using the Snort 2 Detection Engine. The provided information does not identify affected software versions or configurations.