CVE-2022-20767

A vulnerability in the interaction between the TCP Intercept feature and the Snort 3 detection engine on Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured policies. The issue is due to a logic error when handling embryonic (half-open) TCP connections. Devices configured with Snort 2 are not affected.

A vulnerability in the TLS processing feature of Cisco Firepower Threat Defense (FTD) Software for Firepower 2100 Series could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The issue occurs when processing TLS traffic, and exploitation by sending certain TLS traffic over IPv4 could cause the device to reload, impacting traffic through the device.

A vulnerability in the Snort 2 and Snort 3 TCP and UDP detection engine of Cisco Firepower Threat Defense (FTD) Software for Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause memory corruption, leading to unexpected Snort detection engine restarts. The issue is due to improper memory management when processing specific TCP or UDP packets. Exploitation can cause repeated restarts, resulting in a DoS condition.

A vulnerability in the file policy feature used to inspect encrypted archive files of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured file policy to block an encrypted archive file. The issue is due to a logic error when a specific class of encrypted archive files is inspected.

A vulnerability in ICMPv6 inspection when configured with the Snort 2 detection engine for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause CPU usage to spike to 100%, stopping all traffic processing and resulting in a DoS condition. The issue is due to improper error checking when parsing ICMPv6 header fields. Sending a crafted ICMPv6 packet can exhaust CPU resources and stop traffic processing.

A vulnerability in the interaction of SIP and Snort 3 for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to restart. This is due to a lack of error-checking when SIP bidirectional flows are inspected by Snort 3. An attacker could exploit this by sending crafted SIP traffic, leading to a denial of service (DoS) condition.

A vulnerability in the management web server of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with high privileges to execute configuration commands on an affected system. This is due to improper restriction of access to HTTPS endpoints. An attacker could exploit this by sending specific messages to the HTTPS handler, allowing configuration changes that should only be performed through Firepower Management Center (FMC).

A vulnerability in the Snort detection engine integration for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause unlimited memory consumption, leading to DoS. It is due to insufficient memory management for certain Snort events. An attacker can send crafted IP packets to generate specific Snort events, causing out-of-memory and traffic interruption; in some cases, device reload may occur.

A vulnerability in SSH connection processing for multi-instance deployments of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a DoS condition. It is due to improper error handling when an SSH session fails. An attacker can send a high rate of crafted SSH connections, leading to resource exhaustion and DoS; manual reload is required.

A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to restart unexpectedly. It is due to a lack of sufficient memory management protections under heavy SNMP polling loads. An attacker could exploit this by sending a high rate of SNMP requests to the SNMP daemon through the management interface.