CVE-2023-20031
MediumCVSS 4.0Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability in the SSL/TLS certificate handling of Snort 3 Detection Engine integration with Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to restart. This is due to a logic error when an SSL/TLS certificate under load is accessed during SSL connection initiation. An attacker could send a high rate of SSL/TLS connection requests, causing the engine to reload, resulting in a bypass or DoS condition depending on configuration.
Risk Assessment
An attack could cause temporary security bypass or service unavailability, potentially leading to security breaches or operational disruptions. The Snort 3 engine restarts automatically, but protection may be weakened during that time.
Recommendation
Apply Cisco updates for FTD and Snort 3. Limit the rate of SSL/TLS connections and monitor detection engine performance.
Related vulnerabilities
- CVE-2026-107282Critical
Vulnerability in AsyncHttpClient (AHC) library before versions 3.0.13 and 2.16.1 allows cross-host request replay that updates the current request but leaves the target request and proxy context pointing to the original origin. This can send the original host's path, Host header, Authorization credentials, or plaintext request to the replay destination.
- CVE-2026-76268Critical
Vulnerability in Splunk Enterprise before versions 10.4.3 and 10.2.7 allows an unauthenticated user with network access to the Patroni REST API on a search head cluster member to execute attacker-controlled OS commands. The interface does not require authentication for critical configuration operations.
- CVE-2026-95606Critical
Deserialization of untrusted data vulnerability in The Events Calendar plugin allows object injection. Affects versions up to 6.17.4.
- CVE-2026-95605Critical
SQL injection vulnerability in WP Data Access allows blind SQL injection. Affects versions up to 5.5.82.
- CVE-2026-76501Critical
Vulnerability in SRv6 OAM (NGOAM) feature of Cisco NX-OS allows unauthenticated remote attacker to execute arbitrary code with root privileges or cause DoS. Due to improper input validation when NGOAM and SRv6 features are enabled.
- CVE-2026-76500Critical
A security review in Cisco APIC revealed multiple vulnerabilities related to improper control of a resource through its lifetime (CWE-664). These have been addressed in hardening releases.
- CVE-2026-76499Critical
A security review in Cisco APIC revealed multiple vulnerabilities related to improper neutralization issues (CWE-707). These have been addressed in hardening releases.
- CVE-2026-76498Critical
A security review in Cisco APIC revealed multiple vulnerabilities related to improper access control (CWE-284). These have been addressed in hardening releases.
- CVE-2026-76486Critical
Vulnerability in VXLAN OAM (NGOAM) feature of Cisco NX-OS allows unauthenticated remote attacker to execute arbitrary code with root privileges or cause DoS. Due to improper input validation when NGOAM is enabled.
- CVE-2026-76485Critical
Vulnerability in VXLAN OAM (NGOAM) feature of Cisco NX-OS allows unauthenticated remote attacker to execute arbitrary code with root privileges or cause DoS. Due to improper input validation when NGOAM is enabled.
Original NVD description (English source)
A vulnerability in the SSL/TLS certificate handling of Snort 3 Detection Engine integration with Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to restart. This vulnerability is due to a logic error that occurs when an SSL/TLS certificate that is under load is accessed when it is initiating an SSL connection. Under specific, time-based constraints, an attacker could exploit this vulnerability by sending a high rate of SSL/TLS connection requests to be inspected by the Snort 3 detection engine on an affected device. A successful exploit could allow the attacker to cause the Snort 3 detection engine to reload, resulting in either a bypass or a denial of service (DoS) condition, depending on device configuration. The Snort detection engine will restart automatically. No manual intervention is required.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS