CVE-2024-20330
Estado: AnalizadaAlta (7.5)—
A vulnerability in the Snort 2 and Snort 3 TCP and UDP detection engine of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause memory corruption, which could cause the Snort detection engine to restart unexpectedly.
This vulnerability is due to improper memory management when the Snort detection engine processes specific TCP or UDP packets. An attacker could exploit this vulnerability by sending crafted TCP or UDP packets through a device that is inspecting traffic using the Snort detection engine.
Leer descripción completaMostrar menos
A successful exploit could allow the attacker to restart the Snort detection engine repeatedly, which could cause a denial of service (DoS) condition. The DoS condition impacts only the traffic through the device that is examined by the Snort detection engine. The device can still be managed over the network. Note: Once a memory block is corrupted, it cannot be cleared until the Cisco Firepower 2100 Series Appliance is manually reloaded. This means that the Snort detection engine could crash repeatedly, causing traffic that is processed by the Snort detection engine to be dropped until the device is manually reloaded.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.66%
- Percentil entre todas las CVEs puntuadas: 50
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1190Exploit Public-Facing Applicationinitial access95 % - Impacto principal
T1499.004Application or System Exploitationimpact90 %
Vector CVSS muestra acceso remoto sin autenticación (AV:N/PR:N/UI:N); la vulnerabilidad en el motor Snort de FTD causa negación de servicio mediante paquetes TCP/UDP artesanales que provocan reinicio repetido del motor de detección.
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
CWE
- CWE-788
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-20330",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-20330",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-10-23T18:42:48.320834Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 8.6,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 4,
"exploitabilityScore": 3.9
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "psirt@cisco.com",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco Firepower Threat Defense Software",
"versions": [
{
"status": "affected",
"version": "7.0.0"
},
{
"status": "affected",
"version": "7.0.0.1"
},
{
"status": "affected",
"version": "7.0.1"
},
{
"status": "affected",
"version": "7.1.0"
},
{
"status": "affected",
"version": "7.0.1.1"
},
{
"status": "affected",
"version": "7.1.0.1"
},
{
"status": "affected",
"version": "7.0.2"
},
{
"status": "affected",
"version": "7.2.0"
},
{
"status": "affected",
"version": "7.0.2.1"
},
{
"status": "affected",
"version": "7.0.3"
},
{
"status": "affected",
"version": "7.2.0.1"
},
{
"status": "affected",
"version": "7.0.4"
},
{
"status": "affected",
"version": "7.2.1"
},
{
"status": "affected",
"version": "7.0.5"
},
{
"status": "affected",
"version": "7.3.0"
},
{
"status": "affected",
"version": "7.2.2"
},
{
"status": "affected",
"version": "7.2.3"
},
{
"status": "affected",
"version": "7.3.1"
},
{
"status": "affected",
"version": "7.1.0.3"
},
{
"status": "affected",
"version": "7.2.4"
},
{
"status": "affected",
"version": "7.0.6"
},
{
"status": "affected",
"version": "7.2.5"
},
{
"status": "affected",
"version": "7.2.4.1"
},
{
"status": "affected",
"version": "7.3.1.1"
},
{
"status": "affected",
"version": "7.0.6.1"
},
{
"status": "affected",
"version": "7.2.5.1"
},
{
"status": "affected",
"version": "7.4.1"
},
{
"status": "affected",
"version": "7.2.6"
},
{
"status": "affected",
"version": "7.0.6.2"
},
{
"status": "affected",
"version": "7.4.1.1"
},
{
"status": "affected",
"version": "7.2.7"
},
{
"status": "affected",
"version": "7.2.5.2"
},
{
"status": "affected",
"version": "7.3.1.2"
},
{
"status": "affected",
"version": "7.2.8"
},
{
"status": "affected",
"version": "7.4.2"
},
{
"status": "affected",
"version": "7.2.8.1"
},
{
"status": "affected",
"version": "7.0.6.3"
}
],
"defaultStatus": "unknown"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"cpes": [
"cpe:2.3:a:cisco:firepower_threat_defense_software:*:*:*:*:*:*:*:*"
],
"vendor": "cisco",
"product": "firepower_threat_defense_software",
"versions": [
{
"status": "affected",
"version": "7.0.0",
"versionType": "custom",
"lessThanOrEqual": "7.0.6.3"
},
{
"status": "affected",
"version": "7.1.0",
"versionType": "custom",
"lessThanOrEqual": "7.1.0.3"
},
{
"status": "affected",
"version": "7.2.0",
"versionType": "custom",
"lessThanOrEqual": "7.2.8.1"
},
{
"status": "affected",
"version": "7.3.0",
"versionType": "custom",
"lessThanOrEqual": "7.3.1.2."
},
{
"status": "affected",
"version": "7.4.1",
"versionType": "custom",
"lessThanOrEqual": "7.4.2"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2024-10-23T17:15:17.663",
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-M446vbEO",
"tags": [
"Broken Link"
],
"source": "psirt@cisco.com"
},
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd2100-snort-dos-M9HuMt75",
"tags": [
"Vendor Advisory"
],
"source": "psirt@cisco.com"
},
{
"url": "https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75300",
"tags": [
"Vendor Advisory"
],
"source": "psirt@cisco.com"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"description": [
{
"lang": "en",
"value": "CWE-788"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the Snort 2 and Snort 3 TCP and UDP detection engine of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause memory corruption, which could cause the Snort detection engine to restart unexpectedly.\r\n\r\nThis vulnerability is due to improper memory management when the Snort detection engine processes specific TCP or UDP packets. An attacker could exploit this vulnerability by sending crafted TCP or UDP packets through a device that is inspecting traffic using the Snort detection engine. A successful exploit could allow the attacker to restart the Snort detection engine repeatedly, which could cause a denial of service (DoS) condition. The DoS condition impacts only the traffic through the device that is examined by the Snort detection engine. The device can still be managed over the network.\r\nNote: Once a memory block is corrupted, it cannot be cleared until the Cisco Firepower 2100 Series Appliance is manually reloaded. This means that the Snort detection engine could crash repeatedly, causing traffic that is processed by the Snort detection engine to be dropped until the device is manually reloaded."
},
{
"lang": "es",
"value": "Una vulnerabilidad en el motor de detección de TCP y UDP Snort 2 y Snort 3 del software Cisco Firepower Threat Defense (FTD) para los dispositivos Cisco Firepower de la serie 2100 podría permitir que un atacante remoto no autenticado provoque daños en la memoria, lo que podría provocar que el motor de detección de Snort se reinicie inesperadamente. Esta vulnerabilidad se debe a una administración de memoria inadecuada cuando el motor de detección de Snort procesa paquetes TCP o UDP específicos. Un atacante podría aprovechar esta vulnerabilidad enviando paquetes TCP o UDP manipulados a través de un dispositivo que esté inspeccionando el tráfico mediante el motor de detección de Snort. Una explotación exitosa podría permitir al atacante reiniciar el motor de detección de Snort repetidamente, lo que podría provocar una condición de denegación de servicio (DoS). La condición de DoS afecta solo al tráfico a través del dispositivo que examina el motor de detección de Snort. El dispositivo aún se puede administrar a través de la red. Nota: Una vez que se daña un bloque de memoria, no se puede borrar hasta que se vuelva a cargar manualmente el dispositivo Cisco Firepower de la serie 2100. Esto significa que el motor de detección de Snort podría fallar repetidamente, provocando que el tráfico procesado por el motor de detección de Snort se descarte hasta que el dispositivo se vuelva a cargar manualmente."
}
],
"lastModified": "2026-08-11T19:33:44.513",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.0.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "362C30CD-9634-41DD-A5D0-5E0174AE32EB"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.0.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FF19A26F-B257-4932-ADF5-3B585D6B5100"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "893B1060-336A-48B7-BF96-16D6A6752F44"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.0.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "479976B9-5B58-4A84-88C5-D81074DC98B2"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B3232A07-4B12-4681-BE61-9FCEEBE2A1F6"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.0.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1A904332-0AAD-4C6B-9D52-509A9A8B8D51"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1137D6CB-618A-488E-A0A9-C98C8A7CE2EE"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "241A1DC5-7DCB-46D8-98E5-7CDD43968A64"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "32290AE7-B7CF-4AF9-ACB0-6672D7E6B8C8"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.0.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CD417D1D-14B8-46AC-B7DD-35C6565E95C6"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.0.6.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BAE72052-C1B0-4897-8303-BC0EFB3857D9"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.0.6.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "36B7CF16-59A9-4298-90D8-1F4F5988F887"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.0.6.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "32C88FF8-D75D-4B9B-B30E-F6D02C66533B"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3AD3F514-9FBC-403C-8F8F-2507708D685F"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.1.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2155D80A-74AE-4403-8EC4-19054DE3476E"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.1.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "30F5FE5C-E3BE-4C32-BB6F-E3785BA6CD15"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "237462A2-E0CF-4201-9115-D94910F9745B"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2CA2F5B0-0106-4FF2-91BD-AEF3F064F69E"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF9FFE56-9A00-456E-B097-114F714133BD"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0E253A08-B4D4-4E81-9D5A-C15D198C43AC"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "59C7F868-1571-44CC-90E1-7A5EA01E63FC"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7432B6F9-03CD-4373-B281-2A09864E7828"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3D42B7E6-71ED-48BA-B11F-6791FE96C1B2"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "39CC3AC6-6F75-43BF-BBC9-F74AADB74716"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.5.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FFBAC033-FF89-4581-92F6-EA4FFEE40F54"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.5.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5AF3CB27-8315-452F-80E1-5DAF883319B1"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7A910367-E5D5-4817-9DAA-3225D4FA8055"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "38EC17C6-2DA5-4E26-987A-FD14F539F55B"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "25E3D7DE-90EB-4531-BD7D-738637A83CD4"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.8.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4E7FE2B9-65C0-4F7F-8810-72BFE861C521"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DD33999C-8DE7-4C0C-A8E5-1BA7127E36FE"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A977F379-2F93-4A56-B0A6-C45AEF274123"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.3.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DA7FA3B6-D630-42E3-B69F-B20D38B33531"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.3.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9B125CC4-0DAE-4C26-9A27-2532BB09EA8A"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BA983223-35AE-4D2F-B2F5-BA0614908C3B"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "17A31A33-2E84-4C79-86BD-1E9FF4C1DD09"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B58DC884-9430-49D4-AA8B-7FEB7505B7A8"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:firepower_2100:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D23A26EF-5B43-437C-A962-4FC69D8A0FF4"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_2110:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "52D96810-5F79-4A83-B8CA-D015790FCF72"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_2120:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "16FE2945-4975-4003-AE48-7E134E167A7F"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_2130:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "DCE7122A-5AA7-4ECD-B024-E27C9D0CFB7B"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_2140:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "976901BF-C52C-4F81-956A-711AF8A60140"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "psirt@cisco.com"
}