CVE-2026-20054

Multiple Cisco products are affected by a vulnerability in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.  This vulnerability is due to improper error checking when decompressing VBA data. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to enter an infinite loop, causing a DoS condition.

CVSS v3 5.8 MEDIUM

5.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3-vbavuls-96UcVVed

Configurations

No configuration.

History

17 Jun 2026, 10:16

Type	Values Removed	Values Added
Summary		(es) Múltiples productos de Cisco se ven afectados por una vulnerabilidad en la característica VBA de Snort 3 que podría permitir a un atacante remoto no autenticado provocar la caída del motor de detección de Snort 3. Esta vulnerabilidad se debe a una comprobación de errores incorrecta al descomprimir datos VBA. Un atacante podría explotar esta vulnerabilidad enviando datos VBA manipulados al motor de detección de Snort 3 en el dispositivo objetivo. Un exploit exitoso podría permitir al atacante provocar que el motor de detección de Snort 3 entre en un bucle infinito, causando una condición de DoS.

04 Mar 2026, 18:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-04 18:16

Updated : 2026-06-17 10:16

NVD link : CVE-2026-20054

Mitre link : CVE-2026-20054

CVE.ORG link : CVE-2026-20054

JSON object : View

Products Affected

No product.

CWE

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

{"id": "CVE-2026-20054", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20054", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-04T21:30:40.990992Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Cisco", "product": "Cisco Cyber Vision", "versions": [{"status": "affected", "version": "3.0.0"}, {"status": "affected", "version": "3.0.2"}, {"status": "affected", "version": "3.0.3"}, {"status": "affected", "version": "3.0.1"}, {"status": "affected", "version": "3.1.0"}, {"status": "affected", "version": "3.0.4"}, {"status": "affected", "version": "3.1.1"}, {"status": "affected", "version": "3.1.2"}, {"status": "affected", "version": "3.2.0"}, {"status": "affected", "version": "3.0.5"}, {"status": "affected", "version": "3.2.1"}, {"status": "affected", "version": "3.0.6"}, {"status": "affected", "version": "3.2.2"}, {"status": "affected", "version": "3.2.3"}, {"status": "affected", "version": "3.2.4"}, {"status": "affected", "version": "4.0.0"}, {"status": "affected", "version": "4.0.1"}, {"status": "affected", "version": "4.0.2"}, {"status": "affected", "version": "4.0.3"}, {"status": "affected", "version": "4.1.0"}, {"status": "affected", "version": "4.1.1"}, {"status": "affected", "version": "4.1.2"}, {"status": "affected", "version": "4.1.3"}, {"status": "affected", "version": "4.1.4"}, {"status": "affected", "version": "4.2.0"}, {"status": "affected", "version": "4.2.1"}, {"status": "affected", "version": "4.1.5"}, {"status": "affected", "version": "4.2.2"}, {"status": "affected", "version": "4.2.X"}, {"status": "affected", "version": "4.2.3"}, {"status": "affected", "version": "4.2.4"}, {"status": "affected", "version": "4.2.6"}, {"status": "affected", "version": "4.1.6"}, {"status": "affected", "version": "4.3.0"}, {"status": "affected", "version": "4.3.1"}, {"status": "affected", "version": "4.3.2"}, {"status": "affected", "version": "4.3.3"}, {"status": "affected", "version": "4.4.0"}, {"status": "affected", "version": "4.4.1"}, {"status": "affected", "version": "4.4.2"}, {"status": "affected", "version": "4.4.3"}, {"status": "affected", "version": "4.1.7"}, {"status": "affected", "version": "5.0.0"}, {"status": "affected", "version": "5.0.1"}, {"status": "affected", "version": "5.0.2"}, {"status": "affected", "version": "5.1.0"}, {"status": "affected", "version": "5.1.1"}, {"status": "affected", "version": "5.1.2"}, {"status": "affected", "version": "5.1.3"}, {"status": "affected", "version": "5.2.0"}, {"status": "affected", "version": "5.2.1"}, {"status": "affected", "version": "5.3.0"}, {"status": "affected", "version": "5.3.1"}, {"status": "affected", "version": "5.3.2"}], "defaultStatus": "unknown"}, {"vendor": "Cisco", "product": "Cisco Secure Firewall Threat Defense (FTD) Software", "versions": [{"status": "affected", "version": "7.2.0"}, {"status": "affected", "version": "7.2.0.1"}, {"status": "affected", "version": "7.2.1"}, {"status": "affected", "version": "7.3.0"}, {"status": "affected", "version": "7.2.2"}, {"status": "affected", "version": "7.2.3"}, {"status": "affected", "version": "7.3.1"}, {"status": "affected", "version": "7.2.4"}, {"status": "affected", "version": "7.2.5"}, {"status": "affected", "version": "7.2.4.1"}, {"status": "affected", "version": "7.3.1.1"}, {"status": "affected", "version": "7.4.0"}, {"status": "affected", "version": "7.2.5.1"}, {"status": "affected", "version": "7.4.1"}, {"status": "affected", "version": "7.2.6"}, {"status": "affected", "version": "7.4.1.1"}, {"status": "affected", "version": "7.2.7"}, {"status": "affected", "version": "7.2.5.2"}, {"status": "affected", "version": "7.3.1.2"}, {"status": "affected", "version": "7.2.8"}, {"status": "affected", "version": "7.6.0"}, {"status": "affected", "version": "7.4.2"}, {"status": "affected", "version": "7.2.8.1"}, {"status": "affected", "version": "7.4.2.1"}, {"status": "affected", "version": "7.2.9"}, {"status": "affected", "version": "7.7.0"}, {"status": "affected", "version": "7.4.2.2"}, {"status": "affected", "version": "7.2.10"}, {"status": "affected", "version": "7.6.1"}, {"status": "affected", "version": "7.4.2.3"}, {"status": "affected", "version": "7.6.2"}, {"status": "affected", "version": "7.7.10"}, {"status": "affected", "version": "7.6.2.1"}, {"status": "affected", "version": "7.7.10.1"}, {"status": "affected", "version": "7.4.2.4"}, {"status": "affected", "version": "7.2.10.2"}, {"status": "affected", "version": "7.4.3"}], "defaultStatus": "unknown"}, {"vendor": "Cisco", "product": "Cisco UTD SNORT IPS Engine Software", "versions": [{"status": "affected", "version": "3.17.1S"}, {"status": "affected", "version": "16.12.3"}, {"status": "affected", "version": "Fuji-16.9.5"}, {"status": "affected", "version": "16.12.4"}, {"status": "affected", "version": "17.3.1a"}, {"status": "affected", "version": "16.6.6"}, {"status": "affected", "version": "16.12.2"}, {"status": "affected", "version": "Fuji-16.9.6"}, {"status": "affected", "version": "3.17.0S"}, {"status": "affected", "version": "Fuji-16.9.3"}, {"status": "affected", "version": "Denali-16.3.7"}, {"status": "affected", "version": "Fuji-16.9.2"}, {"status": "affected", "version": "Fuji-16.9.4"}, {"status": "affected", "version": "Everest-16.6.4"}, {"status": "affected", "version": "Everest-16.6.3"}, {"status": "affected", "version": "16.6.5"}, {"status": "affected", "version": "Denali-16.3.5"}, {"status": "affected", "version": "17.2.1r"}, {"status": "affected", "version": "17.1.1"}, {"status": "affected", "version": "Everest-16.6.2"}, {"status": "affected", "version": "16.6.7a"}, {"status": "affected", "version": "Denali-16.3.4"}, {"status": "affected", "version": "16.6.1"}, {"status": "affected", "version": "Denali-16.3.9"}, {"status": "affected", "version": "Denali-16.3.3"}, {"status": "affected", "version": "16.12.1a"}, {"status": "affected", "version": "17.3.2"}, {"status": "affected", "version": "17.4.1a"}, {"status": "affected", "version": "16.12.5"}, {"status": "affected", "version": "17.5.1"}, {"status": "affected", "version": "Fuji-16.9.7"}, {"status": "affected", "version": "16.6.9"}, {"status": "affected", "version": "17.3.3"}, {"status": "affected", "version": "17.5.1a"}, {"status": "affected", "version": "17.3.4"}, {"status": "affected", "version": "17.3.4a"}, {"status": "affected", "version": "17.4.2"}, {"status": "affected", "version": "17.4.1b"}, {"status": "affected", "version": "17.6.1a"}, {"status": "affected", "version": "16.6.10"}, {"status": "affected", "version": "17.7.1a"}, {"status": "affected", "version": "16.12.6"}, {"status": "affected", "version": "Fuji-16.9.8"}, {"status": "affected", "version": "17.6.2"}, {"status": "affected", "version": "17.8.1a"}, {"status": "affected", "version": "16.12.7"}, {"status": "affected", "version": "17.3.5"}, {"status": "affected", "version": "17.6.3"}, {"status": "affected", "version": "17.6.3a"}, {"status": "affected", "version": "17.7.2"}, {"status": "affected", "version": "17.9.1a"}, {"status": "affected", "version": "17.6.4"}, {"status": "affected", "version": "17.10.1a"}, {"status": "affected", "version": "17.3.6"}, {"status": "affected", "version": "16.12.8"}, {"status": "affected", "version": "17.3.7"}, {"status": "affected", "version": "17.9.2a"}, {"status": "affected", "version": "17.6.5"}, {"status": "affected", "version": "17.11.1a"}, {"status": "affected", "version": "17.9.3a"}, {"status": "affected", "version": "17.12.1a"}, {"status": "affected", "version": "17.9.4"}, {"status": "affected", "version": "17.6.6"}, {"status": "affected", "version": "17.3.8"}, {"status": "affected", "version": "17.3.8a"}, {"status": "affected", "version": "17.6.6a"}, {"status": "affected", "version": "17.9.4a"}, {"status": "affected", "version": "17.12.2"}, {"status": "affected", "version": "17.13.1a"}, {"status": "affected", "version": "17.9.5a"}, {"status": "affected", "version": "17.12.3"}, {"status": "affected", "version": "17.6.7"}, {"status": "affected", "version": "17.14.1a"}, {"status": "affected", "version": "17.12.4"}, {"status": "affected", "version": "17.12.3a"}, {"status": "affected", "version": "17.15.1a"}, {"status": "affected", "version": "17.6.8"}, {"status": "affected", "version": "17.9.6"}, {"status": "affected", "version": "17.6.8a"}, {"status": "affected", "version": "17.16.1a"}, {"status": "affected", "version": "17.9.5e"}, {"status": "affected", "version": "17.12.4a"}, {"status": "affected", "version": "17.15.2c"}, {"status": "affected", "version": "17.9.5f"}, {"status": "affected", "version": "17.12.4b"}, {"status": "affected", "version": "17.15.2a"}, {"status": "affected", "version": "17.12.5"}, {"status": "affected", "version": "17.17.1"}, {"status": "affected", "version": "17.12.5a"}, {"status": "affected", "version": "17.9.7a"}, {"status": "affected", "version": "17.15.3a"}, {"status": "affected", "version": "17.15.3"}, {"status": "affected", "version": "17.12.5b"}, {"status": "affected", "version": "17.12.5c"}, {"status": "affected", "version": "17.15.4"}, {"status": "affected", "version": "17.9.7b"}, {"status": "affected", "version": "17.18.1"}, {"status": "affected", "version": "17.18.1a"}, {"status": "affected", "version": "17.12.6"}, {"status": "affected", "version": "17.9.8"}, {"status": "affected", "version": "17.15.4c"}, {"status": "affected", "version": "17.12.5d"}, {"status": "affected", "version": "17.18.2"}], "defaultStatus": "unknown"}]}], "published": "2026-03-04T18:16:19.920", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3-vbavuls-96UcVVed", "source": "psirt@cisco.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-835"}]}], "descriptions": [{"lang": "en", "value": "Multiple Cisco products are affected by a vulnerability in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash. \r\n\r\nThis vulnerability is due to improper error checking when decompressing VBA data. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to enter an infinite loop, causing a DoS condition."}, {"lang": "es", "value": "M\u00faltiples productos de Cisco se ven afectados por una vulnerabilidad en la caracter\u00edstica VBA de Snort 3 que podr\u00eda permitir a un atacante remoto no autenticado provocar la ca\u00edda del motor de detecci\u00f3n de Snort 3.\n\nEsta vulnerabilidad se debe a una comprobaci\u00f3n de errores incorrecta al descomprimir datos VBA. Un atacante podr\u00eda explotar esta vulnerabilidad enviando datos VBA manipulados al motor de detecci\u00f3n de Snort 3 en el dispositivo objetivo. Un exploit exitoso podr\u00eda permitir al atacante provocar que el motor de detecci\u00f3n de Snort 3 entre en un bucle infinito, causando una condici\u00f3n de DoS."}], "lastModified": "2026-06-17T10:16:59.303", "sourceIdentifier": "psirt@cisco.com"}