GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2021-1236

Vulnerability from fkie_nvd - Published: 2021-01-13 22:15 - Updated: 2026-08-11 19:37
Severity
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Summary
Multiple Cisco products are affected by a vulnerability in the Snort application detection engine that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. The vulnerability is due to a flaw in the detection algorithm. An attacker could exploit this vulnerability by sending crafted packets that would flow through an affected system. A successful exploit could allow the attacker to bypass the configured policies and deliver a malicious payload to the protected network.
References
psirt@cisco.comhttps://lists.debian.org/debian-lts-announce/2023/02/msg00011.html
psirt@cisco.comhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-app-bypass-cSBYCATqVendor Advisory
psirt@cisco.comhttps://www.debian.org/security/2023/dsa-5354
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2023/02/msg00011.html
af854a3a-2127-422b-91ae-364da2661108https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-app-bypass-cSBYCATqVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2023/dsa-5354
Impacted products
Vendor Product Version
cisco ios_xe *
cisco 1100-4p_integrated_services_router -
cisco 1100-8p_integrated_services_router -
cisco 1101-4p_integrated_services_router -
cisco 1109-2p_integrated_services_router -
cisco 1109-4p_integrated_services_router -
cisco 1111x-8p_integrated_services_router -
cisco 4221_integrated_services_router -
cisco 4321_integrated_services_router -
cisco 4331_integrated_services_router -
cisco 4351_integrated_services_router -
cisco 4431_integrated_services_router -
cisco 4451-x_integrated_services_router -
cisco 4461_integrated_services_router -
cisco csr_1000v -
cisco isa_3000 -
cisco secure_firewall_management_center 2.9.14.0
cisco secure_firewall_management_center 2.9.14.14
cisco secure_firewall_management_center 2.9.15
cisco secure_firewall_management_center 2.9.16
cisco secure_firewall_management_center 2.9.17
cisco secure_firewall_threat_defense *
snort snort *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Cisco Firepower Threat Defense Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "psirt@cisco.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "72B91784-38A9-4A2A-AA92-8AB558924BBD",
              "versionEndExcluding": "17.4.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2D2305B-B69E-4F74-A44E-07B3205CE9F7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "26DD41B3-1D1D-44D3-BA8E-5A66AFEE77E6",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5AAD4397-6DCF-493A-BD61-3A890F6F3AB2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:1109-2p_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3F2F0A8E-97F6-41AC-BE67-4B2D60F9D36B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:1109-4p_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB9229F3-7BCE-46C4-9879-D57B5BAAE44E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:1111x-8p_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A5A606FE-E6F1-43F9-B1CD-D9DF35FC3573",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4221_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6C8AED7C-DDA3-4C29-BB95-6518C02C551A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4321_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9421DBEF-AE42-4234-B49F-FCC34B804D7F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4331_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5419CB9F-241F-4431-914F-2659BE27BEA5",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4351_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7DE02DBE-EAD5-4F37-8AB7-DF46A605A0E2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4431_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5720462A-BE6B-4E84-A1A1-01E80BBA86AD",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4451-x_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "818CEFA6-208C-43C3-8E43-474A93ADCF21",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4461_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8B60888-6E2B-494E-AC65-83337661EE7D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:csr_1000v:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF8B0B49-2C99-410B-B011-5B821C5992FB",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:isa_3000:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9510E97A-FD78-43C6-85BC-223001ACA264",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:2.9.14.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2986D5BD-1936-41BD-A992-7672C019F27E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:2.9.14.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "3D320926-6890-4A7F-85E2-7F46C2791499",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:2.9.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "42493B4F-0CF2-45F0-B72D-36F0597CC274",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:2.9.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "06F2E7D8-BB95-480D-AE3E-F9B97C3A5379",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:2.9.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "6F41C382-C849-465C-AF77-0A787CA03BA7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "02511697-3221-4A6C-8A10-2B1F880D0F9F",
              "versionEndExcluding": "6.5.0.5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:snort:snort:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0ADB3B5E-B17C-4D12-9ABE-1817CED279B2",
              "versionEndExcluding": "2.9.14",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple Cisco products are affected by a vulnerability in the Snort application detection engine that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. The vulnerability is due to a flaw in the detection algorithm. An attacker could exploit this vulnerability by sending crafted packets that would flow through an affected system. A successful exploit could allow the attacker to bypass the configured policies and deliver a malicious payload to the protected network."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples productos de Cisco est\u00e1n afectados por una vulnerabilidad en el motor de detecci\u00f3n de aplicaciones de Snort que podr\u00eda permitir a un atacante remoto no autenticado omitir las pol\u00edticas configuradas en un sistema afectado.\u0026#xa0;La vulnerabilidad es debido a un fallo en el algoritmo de detecci\u00f3n.\u0026#xa0;Un atacante podr\u00eda explotar esta vulnerabilidad mediante el env\u00edo de paquetes dise\u00f1ados que fluir\u00edan a trav\u00e9s de un sistema afectado.\u0026#xa0;Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante omitir las pol\u00edticas configuradas y entregar una carga \u00fatil maliciosa a la red protegida."
    }
  ],
  "id": "CVE-2021-1236",
  "lastModified": "2026-08-11T19:37:30.880",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "psirt@cisco.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-1236",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-11-08T20:55:08.338945Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2021-01-13T22:15:20.583",
  "references": [
    {
      "source": "psirt@cisco.com",
      "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00011.html"
    },
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-app-bypass-cSBYCATq"
    },
    {
      "source": "psirt@cisco.com",
      "url": "https://www.debian.org/security/2023/dsa-5354"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00011.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-app-bypass-cSBYCATq"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.debian.org/security/2023/dsa-5354"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-670"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-670"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.