CVE-2022-20685
📋 TL;DR
An integer overflow vulnerability in Snort's Modbus preprocessor allows remote attackers to cause denial of service by sending crafted Modbus traffic. This affects devices running vulnerable Snort versions, causing traffic inspection to stop when exploited. Cisco has confirmed this vulnerability affects multiple products using Snort.
💻 Affected Systems
- Cisco Firepower Threat Defense (FTD)
- Cisco Firepower Management Center (FMC)
- Other products using vulnerable Snort versions
📦 What is this software?
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
Unified Threat Defense Snort Intrusion Prevention System Engine by Cisco
View all CVEs affecting Unified Threat Defense Snort Intrusion Prevention System Engine →
⚠️ Risk & Real-World Impact
Worst Case
Complete loss of network traffic inspection and monitoring capabilities, potentially allowing undetected malicious traffic to pass through.
Likely Case
Snort process hangs or crashes, requiring manual restart and causing temporary loss of intrusion detection/prevention capabilities.
If Mitigated
No impact if patched or if Modbus traffic is filtered/blocked at network boundaries.
🎯 Exploit Status
Exploitation requires sending crafted Modbus packets to trigger the integer overflow. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Multiple fixed versions depending on product - see Cisco advisories for specific version numbers
Vendor Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-dos-9D3hJLuj
Restart Required: Yes
Instructions:
1. Check current version using 'show version' command. 2. Download appropriate fixed version from Cisco. 3. Apply update following Cisco upgrade procedures. 4. Restart affected services or device.
🔧 Temporary Workarounds
Disable Modbus preprocessor
allDisable Snort's Modbus preprocessor to prevent processing of Modbus traffic that could trigger the vulnerability
Configure via FMC GUI: Policies > Access Control > Advanced > Preprocessors > Disable Modbus
Block Modbus traffic at network boundaries
allUse firewall rules to block Modbus traffic (TCP/UDP port 502) from reaching vulnerable devices
access-list OUTSIDE extended deny tcp any any eq 502
access-list OUTSIDE extended deny udp any any eq 502
🧯 If You Can't Patch
- Implement network segmentation to isolate Modbus traffic from vulnerable devices
- Deploy network-based intrusion prevention systems (IPS) to detect and block exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check Snort version and configuration: 'show version' on FTD or check FMC system informationCheck Version:
show version (on FTD) or check System > Updates in FMCVerify Fix Applied:
Verify installed version matches fixed versions listed in Cisco advisory and test Modbus traffic processing📡 Detection & Monitoring
Log Indicators:
- Snort process crashes or hangs
- High CPU usage followed by process termination
- Modbus traffic spikes preceding service disruption
Network Indicators:
- Crafted Modbus packets with malformed fields
- Traffic patterns targeting port 502 with unusual payloads
SIEM Query:
source="snort" AND (event_type="crash" OR event_type="hang") AND process="snort"