PT-2021-4922 · Cisco · Snort 3+1

Published 2021-10-27 · Updated 2025-07-07 · CVE-2021-40116

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Firepower Threat Defense (FTD) with Snort3 configured and either a rule with Block with Reset or Interactive Block with Reset actions configured

Description The issue is due to improper handling of the Block with Reset or Interactive Block with Reset actions if a rule is configured without proper constraints. An attacker could exploit this by sending a crafted IP packet to the affected device, potentially causing through traffic to be dropped. This could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

Recommendations For Cisco Firepower Threat Defense (FTD) with Snort3 configured, consider disabling the Block with Reset or Interactive Block with Reset actions until a patch is available. Restrict access to devices with Snort3 configured to minimize the risk of exploitation. Avoid using rules with Block with Reset or Interactive Block with Reset actions in Snort3 until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-241

Related Identifiers

BDU:2021-05660

CVE-2021-40116

Affected Products

Cisco Ftd

Snort 3

References · 7

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-dos-RywH7ezM · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-40116 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05660 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-40116 · Security Note
• https://t.me/cibsecurity/31314 · Telegram Post
• https://t.me/cvenotify/127823 · Telegram Post
• https://t.me/cvenotify/22509 · Telegram Post