OTPulse

Multiple Cisco Products Snort 3 Denial of Service Vulnerabilities

MonitorCVSS 5.8cisco-sa-snort3-misc-dos-6mB22qAKOct 21, 2026
Cisco
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Multiple Cisco products are affected by vulnerabilities in Snort 3 Detection Engine versions 17.12.1a through 3.9.7.0 that allow an unauthenticated remote attacker to send crafted network traffic that causes Snort 3 to restart unexpectedly, resulting in a denial of service condition. During the restart, network traffic is not monitored for intrusions or threats.

What this means
What could happen
An attacker could send specially crafted network traffic to cause Snort 3 to crash and restart, interrupting intrusion detection and allowing malicious traffic to pass through undetected during the outage.
Who's at risk
Organizations running Cisco Snort 3 as an intrusion detection or prevention system, including those integrated with Cisco IDS/IPS appliances, network security devices, or deployed on security sensors monitoring network traffic.
How it could be exploited
An attacker on the network sends a malformed packet or series of packets to the Snort 3 sensor. The detection engine encounters an error when processing the traffic, causing the sensor to crash and restart. During the restart window, the network is unmonitored.
Prerequisites
  • Network access to reach the Snort 3 sensor
  • No authentication required
  • Ability to send specific crafted packets that trigger the parsing error
remotely exploitableno authentication requiredlow complexityaffects network monitoring and detection
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (1)
ProductAffected VersionsFix Status
Multiple Cisco Products Snort 317.12.1a through 3.9.7.0Fix available
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Snort 3 to version 3.9.7.0 or later
View full vendor advisory
API: /api/v1/advisories/5118ed9c-6fd1-4019-82a3-94ce9b07c60e

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.