WaratekVRT Sign in

CVE-2022-20922

Affected software2 products, listed below
Severity6.5 Medium CVSS 3.1 2 scores
WeaknessCWE-244
Published15 Nov 2022
Updated11 Aug 2026

Description

Multiple vulnerabilities in the Server Message Block Version 2 (SMB2) processor of the Snort detection engine on multiple Cisco products could allow an unauthenticated, remote attacker to bypass the configured policies or cause a denial of service (DoS) condition on an affected device. These vulnerabilities are due to improper management of system resources when the Snort detection engine is processing SMB2 traffic. An attacker could exploit these vulnerabilities by sending a high rate of certain types of SMB2 packets through an affected device. A successful exploit could allow the attacker to trigger a reload of the Snort process, resulting in a DoS condition. Note: When the snort preserve-connection option is enabled for the Snort detection engine, a successful exploit could also allow the attacker to bypass the configured policies and deliver a malicious payload to the protected network. The snort preserve-connection setting is enabled by default. See the Details ["#details"] section of this advisory for more information. Note: Only products that have Snort 3 configured are affected. Products that are configured with Snort 2 are not affected.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 4 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 0.92% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review automated Upstream data
  • Record active
Decided by The only affected product being a sealed appliance image, where Java runs but no -javaagent can be attached
Finding This CVE names only products the Waratek agent cannot be installed into (cisco/secure_firewall_threat_defense, cisco/cyber_vision). They ship as sealed appliance images or as native code with no application JVM, so there is no start-up line to add -javaagent to. The vulnerability may well be a Java one; it is permanently out of ARMR's reach rather than outside its subject.

CVSS

6.5 MEDIUM v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L NVD Primary published
CVSS 3.1 5.8 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L psirt@cisco.com Secondary

Affected software and releases

Products and versions

3 products, 57 version entries
SourceVendorProductSchemeAffected versions
nvd cisco cyber vision generic 3.0.0 · 3.0.1 · 3.0.2 · 3.0.3 · 3.0.5 · 3.0.6 · 3.1.0 · 3.1.1 · 3.1.2 · 3.2.0 · 3.2.1 · 3.2.2 · 3.2.3 · 3.2.4 · 4.0.0 · 4.0.1 · 4.0.2 · 4.0.3 · 4.1.0 · 4.1.1
nvd cisco secure firewall threat defense generic 7.1.0 · 7.1.0.1 · 7.1.0.2 · 7.2.0 · 7.2.0.1
nvd cisco umbrella virtual appliance generic 1.5.4 · 1.5.5 · 1.5.6 · 2.0.0 · 2.0.2 · 2.0.3 · 2.1.0 · 2.1.2 · 2.1.4 · 2.1.5 · 2.2 · 2.2.1 · 2.3 · 2.3.1 · 2.4 · 2.4.4 · 2.4.6 · 2.4.12 · 2.5 · 2.5.4 · 2.5.5 · 2.5.6 · 2.5.7 · 2.6.0 · 2.6.1 · 2.6.2 · 2.7 · 2.8 · 2.8.9 · 3.0 · 3.1 · 3.2

References

URLTags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-smb-3nfhJtr

Timeline
Published2022-11-15By the CVE Program.
NVD record modified2026-08-11NVD's own last-modified date for this record.