NetSight
IP …
medium5.8

CVE-2021-1224

Multiple Cisco products are affected by a vulnerability with TCP Fast Open (TFO) when used in conjunction with the Snort detection engine that could allow an u…

Impact

Multiple Cisco products are affected by a vulnerability with TCP Fast Open (TFO) when used in conjunction with the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect detection of the HTTP payload if it is contained at least partially within the TFO connection handshake. An attacker could exploit this vulnerability by sending crafted TFO packets with an HTTP payload through an affected device. A successful exploit could allow the attacker to bypass configured file policy for HTTP packets and deliver a malicious payload.

Affected products

VendorProductAffected versions
CiscoSecure Firewall Management Center
Versions 2.9.14.0, 2.9.15, 2.9.16, 2.9.17, 2.9.18, 3.0.1
CiscoSecure Firewall Threat Defense
before 6.7.0
CiscoIos Xe
before 17.4.1
SnortSnort
before 2.9.17
CiscoMeraki Mx64 Firmware
All versions
CiscoMeraki Mx64w Firmware
All versions
CiscoMeraki Mx67 Firmware
All versions
CiscoMeraki Mx67c Firmware
All versions
CiscoMeraki Mx67w Firmware
All versions
CiscoMeraki Mx68 Firmware
All versions
CiscoMeraki Mx68cw Firmware
All versions
CiscoMeraki Mx68w Firmware
All versions

Weakness classification

CWE-693

References