Multiple Cisco Products Snort TCP Fast Open File Policy Bypass Vulnerability

Summary

CVE	CVE-2021-1224
State	PUBLISHED
Assigner	cisco
Source Priority	CVE Program / NVD first with legacy fallback
Published	2021-01-13 22:15:20 UTC
Updated	2026-08-11 19:37:30 UTC
Description	Multiple Cisco products are affected by a vulnerability with TCP Fast Open (TFO) when used in conjunction with the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect detection of the HTTP payload if it is contained at least partially within the TFO connection handshake. An attacker could exploit this vulnerability by sending crafted TFO packets with an HTTP payload through an affected device. A successful exploit could allow the attacker to bypass configured file policy for HTTP packets and deliver a malicious payload.

Risk And Classification

Primary CVSS: v3.1 5.3 MEDIUM from [email protected]

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.020050000 probability, percentile 0.790190000 (date 2026-08-12)

Problem Types: CWE-693 | NVD-CWE-Other | CWE-693 CWE-693

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	5.3	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N`
3.1	[email protected]	Secondary	5.8	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N`
3.1	CNA	DECLARED	5.8	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N`
2.0	[email protected]	Primary	5		`AV:N/AC:L/Au:N/C:N/I:P/A:N`

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVSS v2.0 Breakdown

Access Vector

Network

Access Complexity

Low

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

AV:N/AC:L/Au:N/C:N/I:P/A:N

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Hardware	Cisco	1100-4p Integrated Services Router	-	All	All	All
Hardware	Cisco	1100-8p Integrated Services Router	-	All	All	All
Hardware	Cisco	1101-4p Integrated Services Router	-	All	All	All
Hardware	Cisco	1109-2p Integrated Services Router	-	All	All	All
Hardware	Cisco	1109-4p Integrated Services Router	-	All	All	All
Hardware	Cisco	1111x-8p Integrated Services Router	-	All	All	All
Hardware	Cisco	4221 Integrated Services Router	-	All	All	All
Hardware	Cisco	4321 Integrated Services Router	-	All	All	All
Hardware	Cisco	4331 Integrated Services Router	-	All	All	All
Hardware	Cisco	4351 Integrated Services Router	-	All	All	All
Hardware	Cisco	4431 Integrated Services Router	-	All	All	All
Hardware	Cisco	4451-x Integrated Services Router	-	All	All	All
Hardware	Cisco	4461 Integrated Services Router	-	All	All	All
Hardware	Cisco	Csr 1000v	-	All	All	All
Operating System	Cisco	Ios Xe	All	All	All	All
Hardware	Cisco	Isa 3000	-	All	All	All
Hardware	Cisco	Meraki Mx100	-	All	All	All
Operating System	Cisco	Meraki Mx100 Firmware	-	All	All	All
Hardware	Cisco	Meraki Mx250	-	All	All	All
Operating System	Cisco	Meraki Mx250 Firmware	-	All	All	All
Hardware	Cisco	Meraki Mx450	-	All	All	All
Operating System	Cisco	Meraki Mx450 Firmware	-	All	All	All
Hardware	Cisco	Meraki Mx64	-	All	All	All
Hardware	Cisco	Meraki Mx64w	-	All	All	All
Operating System	Cisco	Meraki Mx64w Firmware	-	All	All	All
Operating System	Cisco	Meraki Mx64 Firmware	-	All	All	All
Hardware	Cisco	Meraki Mx67	-	All	All	All
Hardware	Cisco	Meraki Mx67c	-	All	All	All
Operating System	Cisco	Meraki Mx67c Firmware	-	All	All	All
Hardware	Cisco	Meraki Mx67w	-	All	All	All
Operating System	Cisco	Meraki Mx67w Firmware	-	All	All	All
Operating System	Cisco	Meraki Mx67 Firmware	-	All	All	All
Hardware	Cisco	Meraki Mx68	-	All	All	All
Hardware	Cisco	Meraki Mx68cw	-	All	All	All
Operating System	Cisco	Meraki Mx68cw Firmware	-	All	All	All
Hardware	Cisco	Meraki Mx68w	-	All	All	All
Operating System	Cisco	Meraki Mx68w Firmware	-	All	All	All
Operating System	Cisco	Meraki Mx68 Firmware	-	All	All	All
Hardware	Cisco	Meraki Mx84	-	All	All	All
Operating System	Cisco	Meraki Mx84 Firmware	-	All	All	All
Application	Cisco	Secure Firewall Management Center	2.9.14.0	All	All	All
Application	Cisco	Secure Firewall Management Center	2.9.15	All	All	All
Application	Cisco	Secure Firewall Management Center	2.9.16	All	All	All
Application	Cisco	Secure Firewall Management Center	2.9.17	All	All	All
Application	Cisco	Secure Firewall Management Center	2.9.18	All	All	All
Application	Cisco	Secure Firewall Management Center	3.0.1	All	All	All
Application	Cisco	Secure Firewall Threat Defense	All	All	All	All
Application	Snort	Snort	All	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Cisco	Cisco Firepower Threat Defense Software	affected n/a	Not specified

References

Reference	Source	Link	Tags
Debian -- Security Information -- DSA-5354-1 snort	af854a3a-2127-422b-91ae-364da2661108	www.debian.org
Multiple Cisco Products Snort TCP Fast Open File Policy Bypass Vulnerability	af854a3a-2127-422b-91ae-364da2661108	tools.cisco.com	Vendor Advisory
[SECURITY] [DLA 3317-1] snort security update	af854a3a-2127-422b-91ae-364da2661108	lists.debian.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Additional Advisory Data

Exploits

CNA: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

Legacy QID Mappings

181554 Debian Security Update for snort (DLA 3317-1)
181678 Debian Security Update for snort (DSA 5354-1)