CVE-2025-20359
Full vulnerability record from the local CVENow database.
Description
Multiple Cisco products are affected by a vulnerability in the Snort 3 HTTP Decoder that could allow an unauthenticated, remote attacker to cause the disclosure of possible sensitive data or cause the Snort 3 Detection Engine to crash. This vulnerability is due to an error in the logic of buffer handling when the MIME fields of the HTTP header are parsed. This can result in a buffer under-read. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection that is parsed by Snort 3. A successful exploit could allow the attacker to induce one of two possible outcomes: the unexpected restarting of the Snort 3 Detection Engine, which could cause a denial of service (DoS) condition, or information disclosure of sensitive information in the Snort 3 data stream. Due to the under-read condition, it is possible that sensitive information that is not valid connection data could be returned.
Severity
CRITICAL
CVSS score
9.1
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2025-10-15 17:15:49.230000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-20359",
"sourceIdentifier": "[email protected]",
"published": "2025-10-15T17:15:49.230",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple Cisco products are affected by a vulnerability in the Snort 3 HTTP Decoder that could allow an unauthenticated, remote attacker to cause the disclosure of possible sensitive data or cause the Snort 3 Detection Engine to crash.\r\n\r\nThis vulnerability is due to an error in the logic of buffer handling when the MIME fields of the HTTP header are parsed. This can result in a buffer under-read. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection that is parsed by Snort 3. A successful exploit could allow the attacker to induce one of two possible outcomes: the unexpected restarting of the Snort 3 Detection Engine, which could cause a denial of service (DoS) condition, or information disclosure of sensitive information in the Snort 3 data stream. Due to the under-read condition, it is possible that sensitive information that is not valid connection data could be returned."
},
{
"lang": "es",
"value": "Múltiples productos Cisco se ven afectados por una vulnerabilidad en el decodificador HTTP de Snort 3 que podría permitir a un atacante remoto no autenticado causar la revelación de posibles datos sensibles o provocar la caída del motor de detección de Snort 3.\n\nEsta vulnerabilidad se debe a un error en la lógica del manejo de búferes cuando se analizan los campos MIME del encabezado HTTP. Esto puede resultar en una lectura insuficiente del búfer. Un atacante podría explotar esta vulnerabilidad enviando paquetes HTTP manipulados a través de una conexión establecida que es analizada por Snort 3. Un exploit exitoso podría permitir al atacante inducir uno de dos posibles resultados: el reinicio inesperado del motor de detección de Snort 3, lo que podría causar una condición de denegación de servicio (DoS), o la revelación de información sensible en el flujo de datos de Snort 3. Debido a la condición de lectura insuficiente, es posible que se devuelva información sensible que no sea datos de conexión válidos."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco Cyber Vision",
"defaultStatus": "unknown",
"versions": [
{
"version": "3.0.0",
"status": "affected"
},
{
"version": "3.0.2",
"status": "affected"
},
{
"version": "3.0.3",
"status": "affected"
},
{
"version": "3.0.1",
"status": "affected"
},
{
"version": "3.1.0",
"status": "affected"
},
{
"version": "3.0.4",
"status": "affected"
},
{
"version": "3.1.1",
"status": "affected"
},
{
"version": "3.1.2",
"status": "affected"
},
{
"version": "3.2.0",
"status": "affected"
},
{
"version": "3.0.5",
"status": "affected"
},
{
"version": "3.2.1",
"status": "affected"
},
{
"version": "3.0.6",
"status": "affected"
},
{
"version": "3.2.2",
"status": "affected"
},
{
"version": "3.2.3",
"status": "affected"
},
{
"version": "3.2.4",
"status": "affected"
},
{
"version": "4.0.0",
"status": "affected"
},
{
"version": "4.0.1",
"status": "affected"
},
{
"version": "4.0.2",
"status": "affected"
},
{
"version": "4.0.3",
"status": "affected"
},
{
"version": "4.1.0",
"status": "affected"
},
{
"version": "4.1.1",
"status": "affected"
},
{
"version": "4.1.2",
"status": "affected"
},
{
"version": "4.1.3",
"status": "affected"
},
{
"version": "4.1.4",
"status": "affected"
},
{
"version": "4.2.0",
"status": "affected"
},
{
"version": "4.2.1",
"status": "affected"
},
{
"version": "4.1.5",
"status": "affected"
},
{
"version": "4.2.2",
"status": "affected"
},
{
"version": "4.2.X",
"status": "affected"
},
{
"version": "4.2.3",
"status": "affected"
},
{
"version": "4.2.4",
"status": "affected"
},
{
"version": "4.2.6",
"status": "affected"
},
{
"version": "4.1.6",
"status": "affected"
},
{
"version": "4.3.0",
"status": "affected"
},
{
"version": "4.3.1",
"status": "affected"
},
{
"version": "4.3.2",
"status": "affected"
},
{
"version": "4.3.3",
"status": "affected"
},
{
"version": "4.4.0",
"status": "affected"
},
{
"version": "4.4.1",
"status": "affected"
},
{
"version": "4.4.2",
"status": "affected"
},
{
"version": "4.4.3",
"status": "affected"
},
{
"version": "4.1.7",
"status": "affected"
},
{
"version": "5.0.0",
"status": "affected"
},
{
"version": "5.0.1",
"status": "affected"
},
{
"version": "5.0.2",
"status": "affected"
},
{
"version": "5.1.0",
"status": "affected"
},
{
"version": "5.1.1",
"status": "affected"
},
{
"version": "5.1.2",
"status": "affected"
},
{
"version": "5.1.3",
"status": "affected"
},
{
"version": "5.2.0",
"status": "affected"
},
{
"version": "5.2.1",
"status": "affected"
}
]
},
{
"vendor": "Cisco",
"product": "Cisco Secure Firewall Threat Defense (FTD) Software",
"defaultStatus": "unknown",
"versions": [
{
"version": "7.4.1",
"status": "affected"
},
{
"version": "7.4.1.1",
"status": "affected"
},
{
"version": "7.6.0",
"status": "affected"
},
{
"version": "7.4.2",
"status": "affected"
},
{
"version": "7.4.2.1",
"status": "affected"
},
{
"version": "7.7.0",
"status": "affected"
},
{
"version": "7.4.2.2",
"status": "affected"
},
{
"version": "7.6.1",
"status": "affected"
},
{
"version": "7.4.2.3",
"status": "affected"
},
{
"version": "7.4.2.4",
"status": "affected"
}
]
},
{
"vendor": "Cisco",
"product": "Cisco UTD SNORT IPS Engine Software",
"defaultStatus": "unknown",
"versions": [
{
"version": "3.17.1S",
"status": "affected"
},
{
"version": "16.12.3",
"status": "affected"
},
{
"version": "16.12.4",
"status": "affected"
},
{
"version": "17.3.1a",
"status": "affected"
},
{
"version": "16.6.6",
"status": "affected"
},
{
"version": "16.12.2",
"status": "affected"
},
{
"version": "3.17.0S",
"status": "affected"
},
{
"version": "16.6.5",
"status": "affected"
},
{
"version": "17.2.1r",
"status": "affected"
},
{
"version": "17.1.1",
"status": "affected"
},
{
"version": "16.6.7a",
"status": "affected"
},
{
"version": "16.6.1",
"status": "affected"
},
{
"version": "16.12.1a",
"status": "affected"
},
{
"version": "17.3.2",
"status": "affected"
},
{
"version": "17.4.1a",
"status": "affected"
},
{
"version": "16.12.5",
"status": "affected"
},
{
"version": "17.5.1",
"status": "affected"
},
{
"version": "16.6.9",
"status": "affected"
},
{
"version": "17.3.3",
"status": "affected"
},
{
"version": "17.5.1a",
"status": "affected"
},
{
"version": "17.3.4",
"status": "affected"
},
{
"version": "17.3.4a",
"status": "affected"
},
{
"version": "17.4.2",
"status": "affected"
},
{
"version": "17.4.1b",
"status": "affected"
},
{
"version": "17.6.1a",
"status": "affected"
},
{
"version": "16.6.10",
"status": "affected"
},
{
"version": "17.7.1a",
"status": "affected"
},
{
"version": "16.12.6",
"status": "affected"
},
{
"version": "17.6.2",
"status": "affected"
},
{
"version": "17.8.1a",
"status": "affected"
},
{
"version": "16.12.7",
"status": "affected"
},
{
"version": "17.3.5",
"status": "affected"
},
{
"version": "17.6.3",
"status": "affected"
},
{
"version": "17.6.3a",
"status": "affected"
},
{
"version": "17.7.2",
"status": "affected"
},
{
"version": "17.9.1a",
"status": "affected"
},
{
"version": "17.6.4",
"status": "affected"
},
{
"version": "17.3.6",
"status": "affected"
},
{
"version": "16.12.8",
"status": "affected"
},
{
"version": "17.3.7",
"status": "affected"
},
{
"version": "17.9.2a",
"status": "affected"
},
{
"version": "17.6.5",
"status": "affected"
},
{
"version": "17.11.1a",
"status": "affected"
},
{
"version": "17.12.1a",
"status": "affected"
},
{
"version": "17.6.6",
"status": "affected"
},
{
"version": "17.3.8",
"status": "affected"
},
{
"version": "17.3.8a",
"status": "affected"
},
{
"version": "17.6.6a",
"status": "affected"
},
{
"version": "17.12.2",
"status": "affected"
},
{
"version": "17.12.3",
"status": "affected"
},
{
"version": "17.6.7",
"status": "affected"
},
{
"version": "17.12.3a",
"status": "affected"
},
{
"version": "17.12.4",
"status": "affected"
},
{
"version": "17.6.8",
"status": "affected"
},
{
"version": "17.6.8a",
"status": "affected"
},
{
"version": "17.12.4a",
"status": "affected"
},
{
"version": "17.15.2c",
"status": "affected"
},
{
"version": "17.12.4b",
"status": "affected"
},
{
"version": "17.15.2a",
"status": "affected"
},
{
"version": "17.12.5",
"status": "affected"
},
{
"version": "17.15.3a",
"status": "affected"
},
{
"version": "17.15.3",
"status": "affected"
},
{
"version": "17.12.5b",
"status": "affected"
},
{
"version": "17.15.4",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.9,
"impactScore": 2.5
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-10-15T17:40:59.232004Z",
"id": "CVE-2025-20359",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-127"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:snort:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.0.0-233",
"versionEndExcluding": "3.9.3.0",
"matchCriteriaId": "1FCDD0AB-B7FD-4D7B-8747-08156F987255"
}
]
}
]
}
],
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-tTL8PgVH",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}