CVE-2024-20342
CVE-2024-20342 is a medium-severity vulnerability in Cisco Snort with a CVSS 3.x base score of 5.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1025.
Key facts
- Severity: Medium (CVSS 3.x base score 5.8)
- EPSS exploit prediction: 1% (40th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2024-18057
- Weakness: CWE-1025
- Affected product: Cisco Snort
- Published:
- Last modified:
Description
Multiple Cisco products are affected by a vulnerability in the rate filtering feature of the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured rate limiting filter. This vulnerability is due to an incorrect connection count comparison. An attacker could exploit this vulnerability by sending traffic through an affected device at a rate that exceeds a configured rate filter. A successful exploit could allow the attacker to successfully bypass the rate filter. This could allow unintended traffic to enter the network protected by the affected device.
Frequently asked questions
- What is CVE-2024-20342?
- Multiple Cisco products are affected by a vulnerability in the rate filtering feature of the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured rate limiting filter. This vulnerability is due to an incorrect connection count comparison. An attacker could exploit this vulnerability by sending traffic through an affected device at a rate that exceeds a configured rate filter. A successful exploit could allow the attacker to successfully bypass the rate filter. This could allow unintended traffic to enter the network protected by the affected device.
- How severe is CVE-2024-20342?
- CVE-2024-20342 has a CVSS 3.x base score of 5.8, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
- Is CVE-2024-20342 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (40th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2024-20342?
- CVE-2024-20342 primarily affects Cisco Snort. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2024-20342?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2024-20342 have an EU (EUVD) identifier?
- Yes. CVE-2024-20342 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-18057.
- When was CVE-2024-20342 published?
- CVE-2024-20342 was published on 2024-10-23 and last updated on 2026-06-17.
References
Affected products (4)
- cpe:2.3:a:cisco:snort:*:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:firepower_threat_defense_software:*:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:firepower_threat_defense_software:7.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:firepower_threat_defense_software:7.3.0:*:*:*:*:*:*:*
More vulnerabilities in Cisco Snort
- CVE-2021-40116 — High (CVSS 8.6): Multiple Cisco products are affected by a vulnerability in Snort rules that could allow an unauthenticated, remote…
- CVE-2024-20363 — Medium (CVSS 5.8): Multiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that…
All CVEs affecting Cisco Snort →
Other CWE-1025 vulnerabilities
- CVE-2026-9800 — High (CVSS 8.1): A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all…
- CVE-2026-40880 — High (CVSS 8.1): ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and zebra-consensus version 5.0.2, a…
- CVE-2025-32464 — Medium (CVSS 6.8): HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow…
- CVE-2026-40227 — Medium (CVSS 6.2): In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map…
- CVE-2025-2888 — Medium (CVSS 4.5): During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when…
- CVE-2025-2887 — Medium (CVSS 4.5): During a target rollback, the client fails to detect the rollback for delegated targets. This could cause the client to…