CVE-2021-1236 Multiple Cisco Products Snort Application Detection Engine Policy Bypass Vulnerability

Medium 4.0 Published 13 Jan 2021 Updated 12 Nov 2024

Unauthenticated remote attackers can bypass security policies in Cisco Firepower Threat Defense by sending crafted packets, allowing malicious payloads to reach protected networks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-1236?

CVE-2021-1236 is a medium-severity vulnerability in Cisco Ios Xe, published on 13 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Multiple Cisco products are affected by a vulnerability in the Snort application detection engine that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. The vulnerability is due to a flaw in the detection algorithm. An attacker could exploit this vulnerability by sending crafted packets that would flow through an affected system. A successful exploit could allow the attacker to bypass the configured policies and deliver a malicious payload to the protected network.

Weakness: CWE-670

Which versions are affected by CVE-2021-1236?

It affects 4 products.

Products include Cisco Ios Xe, Cisco Secure Firewall Management Center, Cisco Secure Firewall Threat Defense, Snort Snort.

How do I fix CVE-2021-1236?

Apply the vendor's patch.

Is CVE-2021-1236 being exploited?

There is no known exploitation of CVE-2021-1236 in the wild and no public exploit code.

All Cisco Ios Xe vulnerabilities

Sources

Also known as GHSA-hj38-j9jq-rjpp, UBUNTU-CVE-2021-1236.