CVE-2022-20950
MediumCVSS 5.8Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
A vulnerability in the interaction of SIP and Snort 3 for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to restart. This is due to a lack of error-checking when SIP bidirectional flows are inspected by Snort 3. An attacker could exploit this by sending crafted SIP traffic, leading to a denial of service (DoS) condition.
Risk Assessment
The risk is that an attacker can disrupt the Snort 3 detection engine, causing a denial of service and temporary loss of network protection.
Recommendation
Apply updates provided by Cisco for FTD Software. Monitor SIP traffic and consider restricting access to affected interfaces.
Original NVD description (English source)
A vulnerability in the interaction of SIP and Snort 3 for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to restart. This vulnerability is due to a lack of error-checking when SIP bidirectional flows are being inspected by Snort 3. An attacker could exploit this vulnerability by sending a stream of crafted SIP traffic through an interface on the targeted device. A successful exploit could allow the attacker to trigger a restart of the Snort 3 process, resulting in a denial of service (DoS) condition.