CVE-2024-20342
Estado: AnalizadaAlta (8.6)—
This vulnerability is due to an incorrect connection count comparison. An attacker could exploit this vulnerability by sending traffic through an affected device at a rate that exceeds a configured rate filter. A successful exploit could allow the attacker to successfully bypass the rate filter. This could allow unintended traffic to enter the network protected by the affected device.
Detalles técnicos trazas, registros y código del informe original
Multiple Cisco products are affected by a vulnerability in the rate filtering feature of the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured rate limiting filter.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
- Puntuación base: 8.6
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.49%
- Percentil entre todas las CVEs puntuadas: 40
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1190Exploit Public-Facing Applicationinitial access95 % - Impacto principal
T1565.002Transmitted Data Manipulationimpact75 %
Vulnerabilidad de evasión en filtrado de tasa (Snort) explotable remotamente sin autenticación. El atacante evita defensas de la red permitiendo tráfico no autorizado. Vector AV:N/AC:L/PR:N/UI:N indica T1190 (explotación de aplicación expuesta); impacto: modificación/manipulación de datos en tránsit
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (2)
CWE
- CWE-1025
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-20342",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-20342",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-10-23T18:42:45.746828Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 5.8,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "LOW",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 1.4,
"exploitabilityScore": 3.9
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 8.6,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 4,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "psirt@cisco.com",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco Firepower Threat Defense Software",
"versions": [
{
"status": "affected",
"version": "7.0.0"
},
{
"status": "affected",
"version": "7.0.0.1"
},
{
"status": "affected",
"version": "7.0.1"
},
{
"status": "affected",
"version": "7.1.0"
},
{
"status": "affected",
"version": "7.0.1.1"
},
{
"status": "affected",
"version": "7.1.0.1"
},
{
"status": "affected",
"version": "7.0.2"
},
{
"status": "affected",
"version": "7.2.0"
},
{
"status": "affected",
"version": "7.0.2.1"
},
{
"status": "affected",
"version": "7.0.3"
},
{
"status": "affected",
"version": "7.1.0.2"
},
{
"status": "affected",
"version": "7.2.0.1"
},
{
"status": "affected",
"version": "7.0.4"
},
{
"status": "affected",
"version": "7.2.1"
},
{
"status": "affected",
"version": "7.0.5"
},
{
"status": "affected",
"version": "7.3.0"
},
{
"status": "affected",
"version": "7.2.2"
},
{
"status": "affected",
"version": "7.2.3"
},
{
"status": "affected",
"version": "7.3.1"
},
{
"status": "affected",
"version": "7.1.0.3"
},
{
"status": "affected",
"version": "7.2.4"
},
{
"status": "affected",
"version": "7.0.6"
},
{
"status": "affected",
"version": "7.2.5"
},
{
"status": "affected",
"version": "7.2.4.1"
},
{
"status": "affected",
"version": "7.3.1.1"
},
{
"status": "affected",
"version": "7.4.0"
},
{
"status": "affected",
"version": "7.0.6.1"
},
{
"status": "affected",
"version": "7.2.5.1"
},
{
"status": "affected",
"version": "7.4.1"
},
{
"status": "affected",
"version": "7.4.1.1"
},
{
"status": "affected",
"version": "7.2.5.2"
},
{
"status": "affected",
"version": "7.3.1.2"
}
],
"defaultStatus": "unknown"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"cpes": [
"cpe:2.3:a:cisco:firepower_threat_defense_software:*:*:*:*:*:*:*:*"
],
"vendor": "cisco",
"product": "firepower_threat_defense_software",
"versions": [
{
"status": "affected",
"version": "6.7.0",
"versionType": "custom",
"lessThanOrEqual": "7.4.1.1"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2024-10-23T17:15:18.703",
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-rf-bypass-OY8f3pnM",
"tags": [
"Vendor Advisory"
],
"source": "psirt@cisco.com"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"description": [
{
"lang": "en",
"value": "CWE-1025"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple Cisco products are affected by a vulnerability in the rate filtering feature of the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured rate limiting filter. \r\n\r\nThis vulnerability is due to an incorrect connection count comparison. An attacker could exploit this vulnerability by sending traffic through an affected device at a rate that exceeds a configured rate filter. A successful exploit could allow the attacker to successfully bypass the rate filter. This could allow unintended traffic to enter the network protected by the affected device."
},
{
"lang": "es",
"value": "Varios productos de Cisco se ven afectados por una vulnerabilidad en la función de filtrado de velocidad del motor de detección Snort que podría permitir que un atacante remoto no autenticado eluda un filtro de limitación de velocidad configurado. Esta vulnerabilidad se debe a una comparación incorrecta del recuento de conexiones. Un atacante podría aprovechar esta vulnerabilidad enviando tráfico a través de un dispositivo afectado a una velocidad que supere un filtro de velocidad configurado. Una explotación exitosa podría permitir que el atacante eluda con éxito el filtro de velocidad. Esto podría permitir que el tráfico no deseado ingrese a la red protegida por el dispositivo afectado."
}
],
"lastModified": "2026-08-11T19:40:47.230",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:snort:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ABB4268E-57E8-4254-96DB-98A4CB48C921",
"versionEndExcluding": "3.1.74.0",
"versionStartIncluding": "3.0.0.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "77916B76-0AE3-43B9-B2C7-741696B83B16",
"versionEndExcluding": "7.0.6.2"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AFCEE82D-8519-4F32-81D1-7990E07337EB",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "7.2.0"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2AA11B98-82F3-4B80-92E3-9929D62E2791",
"versionEndExcluding": "7.4.2",
"versionStartIncluding": "7.4.0"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3AD3F514-9FBC-403C-8F8F-2507708D685F"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DD33999C-8DE7-4C0C-A8E5-1BA7127E36FE"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "psirt@cisco.com"
}