CVE-2025-20360 (GCVE-0-2025-20360)
Vulnerability from cvelistv5 – Published: 2025-10-15 16:19 – Updated: 2025-10-15 17:43
VLAI?
Summary
Multiple Cisco products are affected by a vulnerability in the Snort 3 HTTP Decoder that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart.
This vulnerability is due to a lack of complete error checking when the MIME fields of the HTTP header are parsed. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine unexpectedly restarts.
Severity ?
5.8 (Medium)
CWE
- CWE-805 - Buffer Access with Incorrect Length Value
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Cisco | Cisco Secure Firewall Threat Defense (FTD) Software |
Affected:
7.3.0
Affected: 7.3.1 Affected: 7.3.1.1 Affected: 7.3.1.2 Affected: 7.4.0 Affected: 7.4.1 Affected: 7.4.1.1 Affected: 7.4.2 Affected: 7.4.2.1 Affected: 7.4.2.2 Affected: 7.4.2.3 Affected: 7.4.2.4 Affected: 7.6.0 Affected: 7.6.1 Affected: 7.7.0 |
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-20360",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-15T17:40:52.793084Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-15T17:43:48.696Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco Secure Firewall Threat Defense (FTD) Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "7.3.0"
},
{
"status": "affected",
"version": "7.3.1"
},
{
"status": "affected",
"version": "7.3.1.1"
},
{
"status": "affected",
"version": "7.3.1.2"
},
{
"status": "affected",
"version": "7.4.0"
},
{
"status": "affected",
"version": "7.4.1"
},
{
"status": "affected",
"version": "7.4.1.1"
},
{
"status": "affected",
"version": "7.4.2"
},
{
"status": "affected",
"version": "7.4.2.1"
},
{
"status": "affected",
"version": "7.4.2.2"
},
{
"status": "affected",
"version": "7.4.2.3"
},
{
"status": "affected",
"version": "7.4.2.4"
},
{
"status": "affected",
"version": "7.6.0"
},
{
"status": "affected",
"version": "7.6.1"
},
{
"status": "affected",
"version": "7.7.0"
}
]
},
{
"product": "Cisco Cyber Vision",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "3.0.4"
},
{
"status": "affected",
"version": "3.0.0"
},
{
"status": "affected",
"version": "3.0.1"
},
{
"status": "affected",
"version": "3.0.2"
},
{
"status": "affected",
"version": "3.0.3"
},
{
"status": "affected",
"version": "3.0.5"
},
{
"status": "affected",
"version": "3.0.6"
},
{
"status": "affected",
"version": "3.1.0"
},
{
"status": "affected",
"version": "3.1.2"
},
{
"status": "affected",
"version": "3.1.1"
},
{
"status": "affected",
"version": "3.2.3"
},
{
"status": "affected",
"version": "3.2.1"
},
{
"status": "affected",
"version": "3.2.4"
},
{
"status": "affected",
"version": "3.2.0"
},
{
"status": "affected",
"version": "3.2.2"
},
{
"status": "affected",
"version": "4.0.0"
},
{
"status": "affected",
"version": "4.0.1"
},
{
"status": "affected",
"version": "4.0.2"
},
{
"status": "affected",
"version": "4.0.3"
},
{
"status": "affected",
"version": "4.1.0"
},
{
"status": "affected",
"version": "4.1.1"
},
{
"status": "affected",
"version": "4.1.2"
},
{
"status": "affected",
"version": "4.1.3"
},
{
"status": "affected",
"version": "4.1.4"
},
{
"status": "affected",
"version": "4.1.5"
},
{
"status": "affected",
"version": "4.1.6"
},
{
"status": "affected",
"version": "4.1.7"
},
{
"status": "affected",
"version": "4.2.0"
},
{
"status": "affected",
"version": "4.2.1"
},
{
"status": "affected",
"version": "4.2.4"
},
{
"status": "affected",
"version": "4.2.6"
},
{
"status": "affected",
"version": "4.2.2"
},
{
"status": "affected",
"version": "4.2.3"
},
{
"status": "affected",
"version": "4.3.0"
},
{
"status": "affected",
"version": "4.3.1"
},
{
"status": "affected",
"version": "4.3.2"
},
{
"status": "affected",
"version": "4.3.3"
},
{
"status": "affected",
"version": "4.4.0"
},
{
"status": "affected",
"version": "4.4.1"
},
{
"status": "affected",
"version": "4.4.2"
},
{
"status": "affected",
"version": "4.4.3"
},
{
"status": "affected",
"version": "5.0.0"
},
{
"status": "affected",
"version": "5.0.1"
},
{
"status": "affected",
"version": "5.0.2"
},
{
"status": "affected",
"version": "5.1.1"
},
{
"status": "affected",
"version": "5.1.2"
},
{
"status": "affected",
"version": "5.1.3"
},
{
"status": "affected",
"version": "5.2.0"
},
{
"status": "affected",
"version": "5.2.1"
}
]
},
{
"product": "Cisco UTD SNORT IPS Engine Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple Cisco products are affected by a vulnerability in the Snort 3 HTTP Decoder that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart.\r\n\r This vulnerability is due to a lack of complete error checking when the MIME fields of the HTTP header are parsed. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine unexpectedly restarts."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-805",
"description": "Buffer Access with Incorrect Length Value",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-15T16:19:46.840Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-snort3-mime-vulns-tTL8PgVH",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-tTL8PgVH"
}
],
"source": {
"advisory": "cisco-sa-snort3-mime-vulns-tTL8PgVH",
"defects": [
"CSCwq42161",
"CSCwq03467",
"CSCwo71401"
],
"discovery": "INTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2025-20360",
"datePublished": "2025-10-15T16:19:46.840Z",
"dateReserved": "2024-10-10T19:15:13.258Z",
"dateUpdated": "2025-10-15T17:43:48.696Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-20360\",\"sourceIdentifier\":\"psirt@cisco.com\",\"published\":\"2025-10-15T17:15:49.433\",\"lastModified\":\"2025-10-16T15:28:59.610\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Multiple Cisco products are affected by a vulnerability in the Snort 3 HTTP Decoder that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart.\\r\\n\\r This vulnerability is due to a lack of complete error checking when the MIME fields of the HTTP header are parsed. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine unexpectedly restarts.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L\",\"baseScore\":5.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-805\"}]}],\"references\":[{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-tTL8PgVH\",\"source\":\"psirt@cisco.com\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-20360\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-15T17:40:52.793084Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-15T17:43:45.397Z\"}}], \"cna\": {\"source\": {\"defects\": [\"CSCwq42161\", \"CSCwq03467\", \"CSCwo71401\"], \"advisory\": \"cisco-sa-snort3-mime-vulns-tTL8PgVH\", \"discovery\": \"INTERNAL\"}, \"metrics\": [{\"format\": \"cvssV3_1\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 5.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"Cisco\", \"product\": \"Cisco Secure Firewall Threat Defense (FTD) Software\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.3.0\"}, {\"status\": \"affected\", \"version\": \"7.3.1\"}, {\"status\": \"affected\", \"version\": \"7.3.1.1\"}, {\"status\": \"affected\", \"version\": \"7.3.1.2\"}, {\"status\": \"affected\", \"version\": \"7.4.0\"}, {\"status\": \"affected\", \"version\": \"7.4.1\"}, {\"status\": \"affected\", \"version\": \"7.4.1.1\"}, {\"status\": \"affected\", \"version\": \"7.4.2\"}, {\"status\": \"affected\", \"version\": \"7.4.2.1\"}, {\"status\": \"affected\", \"version\": \"7.4.2.2\"}, {\"status\": \"affected\", \"version\": \"7.4.2.3\"}, {\"status\": \"affected\", \"version\": \"7.4.2.4\"}, {\"status\": \"affected\", \"version\": \"7.6.0\"}, {\"status\": \"affected\", \"version\": \"7.6.1\"}, {\"status\": \"affected\", \"version\": \"7.7.0\"}]}, {\"vendor\": \"Cisco\", \"product\": \"Cisco Cyber Vision\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.0.4\"}, {\"status\": \"affected\", \"version\": \"3.0.0\"}, {\"status\": \"affected\", \"version\": \"3.0.1\"}, {\"status\": \"affected\", \"version\": \"3.0.2\"}, {\"status\": \"affected\", \"version\": \"3.0.3\"}, {\"status\": \"affected\", \"version\": \"3.0.5\"}, {\"status\": \"affected\", \"version\": \"3.0.6\"}, {\"status\": \"affected\", \"version\": \"3.1.0\"}, {\"status\": \"affected\", \"version\": \"3.1.2\"}, {\"status\": \"affected\", \"version\": \"3.1.1\"}, {\"status\": \"affected\", \"version\": \"3.2.3\"}, {\"status\": \"affected\", \"version\": \"3.2.1\"}, {\"status\": \"affected\", \"version\": \"3.2.4\"}, {\"status\": \"affected\", \"version\": \"3.2.0\"}, {\"status\": \"affected\", \"version\": \"3.2.2\"}, {\"status\": \"affected\", \"version\": \"4.0.0\"}, {\"status\": \"affected\", \"version\": \"4.0.1\"}, {\"status\": \"affected\", \"version\": \"4.0.2\"}, {\"status\": \"affected\", \"version\": \"4.0.3\"}, {\"status\": \"affected\", \"version\": \"4.1.0\"}, {\"status\": \"affected\", \"version\": \"4.1.1\"}, {\"status\": \"affected\", \"version\": \"4.1.2\"}, {\"status\": \"affected\", \"version\": \"4.1.3\"}, {\"status\": \"affected\", \"version\": \"4.1.4\"}, {\"status\": \"affected\", \"version\": \"4.1.5\"}, {\"status\": \"affected\", \"version\": \"4.1.6\"}, {\"status\": \"affected\", \"version\": \"4.1.7\"}, {\"status\": \"affected\", \"version\": \"4.2.0\"}, {\"status\": \"affected\", \"version\": \"4.2.1\"}, {\"status\": \"affected\", \"version\": \"4.2.4\"}, {\"status\": \"affected\", \"version\": \"4.2.6\"}, {\"status\": \"affected\", \"version\": \"4.2.2\"}, {\"status\": \"affected\", \"version\": \"4.2.3\"}, {\"status\": \"affected\", \"version\": \"4.3.0\"}, {\"status\": \"affected\", \"version\": \"4.3.1\"}, {\"status\": \"affected\", \"version\": \"4.3.2\"}, {\"status\": \"affected\", \"version\": \"4.3.3\"}, {\"status\": \"affected\", \"version\": \"4.4.0\"}, {\"status\": \"affected\", \"version\": \"4.4.1\"}, {\"status\": \"affected\", \"version\": \"4.4.2\"}, {\"status\": \"affected\", \"version\": \"4.4.3\"}, {\"status\": \"affected\", \"version\": \"5.0.0\"}, {\"status\": \"affected\", \"version\": \"5.0.1\"}, {\"status\": \"affected\", \"version\": \"5.0.2\"}, {\"status\": \"affected\", \"version\": \"5.1.1\"}, {\"status\": \"affected\", \"version\": \"5.1.2\"}, {\"status\": \"affected\", \"version\": \"5.1.3\"}, {\"status\": \"affected\", \"version\": \"5.2.0\"}, {\"status\": \"affected\", \"version\": \"5.2.1\"}]}, {\"vendor\": \"Cisco\", \"product\": \"Cisco UTD SNORT IPS Engine Software\", \"versions\": [{\"status\": \"affected\", \"version\": \"N/A\"}]}], \"exploits\": [{\"lang\": \"en\", \"value\": \"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.\"}], \"references\": [{\"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-tTL8PgVH\", \"name\": \"cisco-sa-snort3-mime-vulns-tTL8PgVH\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Multiple Cisco products are affected by a vulnerability in the Snort 3 HTTP Decoder that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart.\\r\\n\\r This vulnerability is due to a lack of complete error checking when the MIME fields of the HTTP header are parsed. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine unexpectedly restarts.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"cwe\", \"cweId\": \"CWE-805\", \"description\": \"Buffer Access with Incorrect Length Value\"}]}], \"providerMetadata\": {\"orgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"shortName\": \"cisco\", \"dateUpdated\": \"2025-10-15T16:19:46.840Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-20360\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-15T17:43:48.696Z\", \"dateReserved\": \"2024-10-10T19:15:13.258Z\", \"assignerOrgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"datePublished\": \"2025-10-15T16:19:46.840Z\", \"assignerShortName\": \"cisco\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…