Cisco Snort Detection Engine Vulnerability Could Lead to DoS Conditions

CVE-2022-20685

Summary

A vulnerability exists within the Modbus preprocessor of the Snort detection engine which could enable an unauthenticated remote attacker to exploit the device, resulting in a denial of service condition. The root cause lies in an integer overflow that occurs when the system processes Modbus traffic. By sending specially crafted Modbus messages, an attacker can induce the Snort process to become unresponsive, leading to a halt in traffic inspection. Cisco has issued software updates addressing this vulnerability, with no applicable workarounds available.

References