CVE-2025-20360
Full vulnerability record from the local CVENow database.
Description
Multiple Cisco products are affected by a vulnerability in the Snort 3 HTTP Decoder that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart. This vulnerability is due to a lack of complete error checking when the MIME fields of the HTTP header are parsed. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine unexpectedly restarts.
Severity
MEDIUM
CVSS score
5.8
(v3.1)
Vulnerability status
Deferred
Source identifier
Published
2025-10-15 17:15:49.433000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-20360",
"sourceIdentifier": "[email protected]",
"published": "2025-10-15T17:15:49.433",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple Cisco products are affected by a vulnerability in the Snort 3 HTTP Decoder that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart.\r\n\r\nThis vulnerability is due to a lack of complete error checking when the MIME fields of the HTTP header are parsed. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine unexpectedly restarts."
},
{
"lang": "es",
"value": "Múltiples productos Cisco se ven afectados por una vulnerabilidad en el decodificador HTTP de Snort 3 que podría permitir a un atacante remoto no autenticado provocar el reinicio del motor de detección de Snort 3.\n\nEsta vulnerabilidad se debe a una falta de comprobación completa de errores al analizar los campos MIME de la cabecera HTTP. Un atacante podría explotar esta vulnerabilidad enviando paquetes HTTP manipulados a través de una conexión establecida para ser analizados por Snort 3. Un exploit exitoso podría permitir al atacante provocar una condición de DoS cuando el motor de detección de Snort 3 se reinicia inesperadamente."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco Cyber Vision",
"defaultStatus": "unknown",
"versions": [
{
"version": "3.0.0",
"status": "affected"
},
{
"version": "3.0.2",
"status": "affected"
},
{
"version": "3.0.3",
"status": "affected"
},
{
"version": "3.0.1",
"status": "affected"
},
{
"version": "3.1.0",
"status": "affected"
},
{
"version": "3.0.4",
"status": "affected"
},
{
"version": "3.1.1",
"status": "affected"
},
{
"version": "3.1.2",
"status": "affected"
},
{
"version": "3.2.0",
"status": "affected"
},
{
"version": "3.0.5",
"status": "affected"
},
{
"version": "3.2.1",
"status": "affected"
},
{
"version": "3.0.6",
"status": "affected"
},
{
"version": "3.2.2",
"status": "affected"
},
{
"version": "3.2.3",
"status": "affected"
},
{
"version": "3.2.4",
"status": "affected"
},
{
"version": "4.0.0",
"status": "affected"
},
{
"version": "4.0.1",
"status": "affected"
},
{
"version": "4.0.2",
"status": "affected"
},
{
"version": "4.0.3",
"status": "affected"
},
{
"version": "4.1.0",
"status": "affected"
},
{
"version": "4.1.1",
"status": "affected"
},
{
"version": "4.1.2",
"status": "affected"
},
{
"version": "4.1.3",
"status": "affected"
},
{
"version": "4.1.4",
"status": "affected"
},
{
"version": "4.2.0",
"status": "affected"
},
{
"version": "4.2.1",
"status": "affected"
},
{
"version": "4.1.5",
"status": "affected"
},
{
"version": "4.2.2",
"status": "affected"
},
{
"version": "4.2.X",
"status": "affected"
},
{
"version": "4.2.3",
"status": "affected"
},
{
"version": "4.2.4",
"status": "affected"
},
{
"version": "4.2.6",
"status": "affected"
},
{
"version": "4.1.6",
"status": "affected"
},
{
"version": "4.3.0",
"status": "affected"
},
{
"version": "4.3.1",
"status": "affected"
},
{
"version": "4.3.2",
"status": "affected"
},
{
"version": "4.3.3",
"status": "affected"
},
{
"version": "4.4.0",
"status": "affected"
},
{
"version": "4.4.1",
"status": "affected"
},
{
"version": "4.4.2",
"status": "affected"
},
{
"version": "4.4.3",
"status": "affected"
},
{
"version": "4.1.7",
"status": "affected"
},
{
"version": "5.0.0",
"status": "affected"
},
{
"version": "5.0.1",
"status": "affected"
},
{
"version": "5.0.2",
"status": "affected"
},
{
"version": "5.1.0",
"status": "affected"
},
{
"version": "5.1.1",
"status": "affected"
},
{
"version": "5.1.2",
"status": "affected"
},
{
"version": "5.1.3",
"status": "affected"
},
{
"version": "5.2.0",
"status": "affected"
},
{
"version": "5.2.1",
"status": "affected"
}
]
},
{
"vendor": "Cisco",
"product": "Cisco Secure Firewall Threat Defense (FTD) Software",
"defaultStatus": "unknown",
"versions": [
{
"version": "7.3.0",
"status": "affected"
},
{
"version": "7.3.1",
"status": "affected"
},
{
"version": "7.3.1.1",
"status": "affected"
},
{
"version": "7.4.0",
"status": "affected"
},
{
"version": "7.4.1",
"status": "affected"
},
{
"version": "7.4.1.1",
"status": "affected"
},
{
"version": "7.3.1.2",
"status": "affected"
},
{
"version": "7.6.0",
"status": "affected"
},
{
"version": "7.4.2",
"status": "affected"
},
{
"version": "7.4.2.1",
"status": "affected"
},
{
"version": "7.7.0",
"status": "affected"
},
{
"version": "7.4.2.2",
"status": "affected"
},
{
"version": "7.6.1",
"status": "affected"
},
{
"version": "7.4.2.3",
"status": "affected"
},
{
"version": "7.4.2.4",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-10-15T17:40:52.793084Z",
"id": "CVE-2025-20360",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-805"
}
]
}
],
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-tTL8PgVH",
"source": "[email protected]"
}
]
}