CVE-2021-1224
MediumCVSS 5.8Exploitation Probability (EPSS)
High risk79th percentile - higher than 79% of all known CVEs
Summary
A vulnerability with TCP Fast Open (TFO) when used with the Snort detection engine in multiple Cisco products could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The issue is due to incorrect detection of the HTTP payload if it is contained at least partially within the TFO connection handshake. An attacker could send crafted TFO packets with an HTTP payload through an affected device, potentially bypassing the policy and delivering a malicious payload.
Risk Assessment
The risk is that an attacker can bypass file policy and deliver malware to the protected network.
Recommendation
It is recommended to upgrade to a patched version and consider disabling TFO if not required.
Original NVD description (English source)
Multiple Cisco products are affected by a vulnerability with TCP Fast Open (TFO) when used in conjunction with the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect detection of the HTTP payload if it is contained at least partially within the TFO connection handshake. An attacker could exploit this vulnerability by sending crafted TFO packets with an HTTP payload through an affected device. A successful exploit could allow the attacker to bypass configured file policy for HTTP packets and deliver a malicious payload.