CyberSecBulletin
CVE-2025-20359NVD status: Analyzed

Cisco Cyber Vision: Buffer Under-read

Published Updated By the CyberSecBulletin desk

CVE-2025-20359 is a critical-severity buffer under-read vulnerability in Cisco Cyber Vision from Cisco, with a CVSS 3.1 base score of 9.1 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected Cisco Cyber Vision versions: 3.0.0; 3.0.2; 3.0.3, and others listed below. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.48% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Snort to 3.9.3.0 or a later version.
  2. Read the advisory on sec.cloudapps.cisco.com for workarounds and exact fixed builds.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
CiscoCisco Cyber Vision3.0.0; 3.0.2; 3.0.3; 3.0.1; 3.1.0; 3.0.4; 3.1.1; 3.1.2; and 32 more rangesNot stated
CiscoCisco Secure Firewall Threat Defense (FTD) Software7.4.1; 7.4.1.1; 7.6.0; 7.4.2; 7.4.2.1; 7.7.0; 7.4.2.2; 7.6.1; and 2 more rangesNot stated
CiscoCisco UTD SNORT IPS Engine Software3.17.1S; 16.12.3; 16.12.4; 17.3.1a; 16.6.6; 16.12.2; 3.17.0S; 16.6.5; and 32 more rangesNot stated
CiscoSnort3.0.0-233 up to, but not including, 3.9.3.03.9.3.0

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.16.5MediumCNA (cisco.com)
CVSS 3.19.1CriticalNVD

Official description

Multiple Cisco products are affected by a vulnerability in the Snort 3 HTTP Decoder that could allow an unauthenticated, remote attacker to cause the disclosure of possible sensitive data or cause the Snort 3 Detection Engine to crash. This vulnerability is due to an error in the logic of buffer handling when the MIME fields of the HTTP header are parsed. This can result in a buffer under-read. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection that is parsed by Snort 3. A successful exploit could allow the attacker to induce one of two possible outcomes: the unexpected restarting of the Snort 3 Detection Engine, which could cause a denial of service (DoS) condition, or information disclosure of sensitive information in the Snort 3 data stream. Due to the under-read condition, it is possible that sensitive information that is not valid connection data could be returned.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Buffer Under-read

The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations prior to the targeted buffer.

More Buffer Under-read vulnerabilities (CWE-127)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in Cisco Cyber Vision

All Cisco Cyber Vision vulnerabilities

Spotted an error? Tell us.