CVE-2020-3299

Multiple Cisco Products SNORT HTTP Detection Engine File Policy Bypass Vulnerability

MEDIUM

5.8

CVSS Score

Published: October 21, 2020 at 06:25 PM UTC

Updated: August 11, 2026 at 07:33 PM UTC

16 products affected across 2 vendorsSecure Firewall Threat DefenseSnort4431 Integrated Services Router

Using Cisco Firepower Threat Defense Software by Cisco?

Get instant alerts when new vulnerabilities affect Cisco Firepower Threat Defense Software - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.8

Exploit prediction

EPSS 2%

SSVC

No known exploit

Description

Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured File Policy for HTTP. The vulnerability is due to incorrect detection of modified HTTP packets used in chunked responses. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass a configured File Policy for HTTP packets and deliver a malicious payload.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Secure Firewall Threat Defense · Cisco

95%

6.0.0 ≤ v < 6.3.0.1

cisco-1100-4p (environment) · cisco-1100-8p (environment) · cisco-1101-4p (environment) · cisco-1109-2p (environment) · cisco-1109-4p (environment) · cisco-1111x-8p (environment) · cisco-4221-integrated-services-router (environment) · cisco-4331-integrated-services-router (environment) · cisco-4431-integrated-services-router (environment) · cisco-4461-integrated-services-router (environment) · cisco-cloud-services-router-1000v (environment) · cisco-isa-3000 (environment) · cisco-isrv (environment) · cisco-meraki-mx (environment)

Snort · Snort

95%

v < 2.9.13.1

Affected range stops below 2.9.13.1, so it looks safe — our inference, not a vendor statement

1100-4P · Ciscodevice

80%

All versions

1100-8P · Ciscodevice

80%

All versions

1101-4P · Ciscodevice

80%