Multiple Cisco Products SNORT HTTP Detection Engine File Policy Bypass Vulnerability
Summary
| CVE | CVE-2020-3299 |
|---|---|
| State | PUBLISHED |
| Assigner | cisco |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-10-21 19:15:15 UTC |
| Updated | 2026-08-11 19:33:44 UTC |
| Description | Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured File Policy for HTTP. The vulnerability is due to incorrect detection of modified HTTP packets used in chunked responses. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass a configured File Policy for HTTP packets and deliver a malicious payload. |
Risk And Classification
Primary CVSS: v3.1 5.8 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
EPSS: 0.023070000 probability, percentile 0.817920000 (date 2026-08-12)
Problem Types: CWE-693 | NVD-CWE-Other | CWE-693 CWE-693
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 5.8 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N |
| 3.0 | [email protected] | Secondary | 5.8 | MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N |
| 3.0 | CNA | DECLARED | 5.8 | MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N |
| 2.0 | [email protected] | Primary | 5 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
ChangedConfidentiality
NoneIntegrity
LowAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CVSS v3.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
ChangedConfidentiality
NoneIntegrity
LowAvailability
NoneCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:L/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware | Cisco | 1100-4p | - | All | All | All |
| Hardware | Cisco | 1100-8p | - | All | All | All |
| Hardware | Cisco | 1101-4p | - | All | All | All |
| Hardware | Cisco | 1109-2p | - | All | All | All |
| Hardware | Cisco | 1109-4p | - | All | All | All |
| Hardware | Cisco | 1111x-8p | - | All | All | All |
| Hardware | Cisco | 4221 Integrated Services Router | - | All | All | All |
| Hardware | Cisco | 4331 Integrated Services Router | - | All | All | All |
| Hardware | Cisco | 4431 Integrated Services Router | - | All | All | All |
| Hardware | Cisco | 4461 Integrated Services Router | - | All | All | All |
| Application | Cisco | Cloud Services Router 1000v | - | All | All | All |
| Hardware | Cisco | Isa 3000 | - | All | All | All |
| Application | Cisco | Isrv | - | All | All | All |
| Hardware | Cisco | Meraki Mx | - | All | All | All |
| Application | Cisco | Secure Firewall Threat Defense | All | All | All | All |
| Application | Snort | Snort | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Cisco | Cisco Firepower Threat Defense Software | affected n/a | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Debian -- Security Information -- DSA-5354-1 snort | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| [SECURITY] [DLA 3317-1] snort security update | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | |
| Multiple Cisco Products SNORT HTTP Detection Engine File Policy Bypass Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | tools.cisco.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Exploits
CNA: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.