CVE-2024-20351 Overview
CVE-2024-20351 is a denial of service (DoS) vulnerability in the TCP/IP traffic handling function of the Snort Detection Engine used by Cisco Firepower Threat Defense (FTD) Software and Cisco FirePOWER Services. An unauthenticated, remote attacker can send a large volume of crafted TCP/IP traffic through an affected device to force the Snort engine to drop legitimate traffic. The condition persists until the device is rebooted, interrupting all inspected network flows. The flaw is tracked under CWE-400 (Uncontrolled Resource Consumption) and affects a wide range of FTD releases from 6.2.3 through 7.4.1.1.
Critical Impact
Successful exploitation causes the affected Cisco FTD device to drop legitimate network traffic, creating a sustained outage that can only be cleared by rebooting the appliance.
Affected Products
- Cisco Firepower Threat Defense (FTD) Software, versions 6.2.3 through 7.4.1.1
- Cisco FirePOWER Services running the Snort Detection Engine
- Snort-based deployments across FTD 6.4.x, 6.6.x, 6.7.x, 7.0.x, 7.1.x, 7.2.x, 7.3.x, and 7.4.x branches
Discovery Timeline
- 2024-10-23 - CVE-2024-20351 published to NVD
- 2025-08-11 - Last updated in NVD database
Technical Details for CVE-2024-20351
Vulnerability Analysis
The vulnerability resides in the TCP/IP traffic handling logic of the Snort Detection Engine integrated with Cisco FTD and FirePOWER Services. When the engine processes a sustained, high-volume stream of TCP/IP packets, internal traffic-handling resources are not released or throttled correctly. The Snort process enters a state in which it begins discarding legitimate inspected traffic that should otherwise be forwarded. Because the affected device sits inline, the result is a network-wide DoS that blocks traffic flowing through the inspection path. Recovery requires a full reboot of the FTD appliance, since the engine does not self-recover or shed load gracefully.
Root Cause
The root cause is improper handling of TCP/IP network traffic inside the Snort detection pipeline, classified as Uncontrolled Resource Consumption [CWE-400]. The engine lacks adequate rate limiting or resource bounding when processing large volumes of TCP/IP packets, allowing internal state or queues to reach a condition where forwarding decisions degrade to drops.
Attack Vector
An unauthenticated, remote attacker exploits the issue by sending a large amount of TCP/IP network traffic through the affected device. No authentication, privileges, or user interaction are required. The traffic does not need to terminate on the FTD itself — it only needs to traverse the device so that Snort inspects it. Once the engine reaches the failure state, traffic drops continue until administrators reboot the device.
No public proof-of-concept or exploit code is currently available for CVE-2024-20351, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Cisco Security Advisory for FTD Snort Firewall for vendor-confirmed technical details.
Detection Methods for CVE-2024-20351
Indicators of Compromise
- Sudden, sustained drops of legitimate traffic transiting an FTD or FirePOWER Services device with no matching access control policy change.
- Snort process or detection engine reporting elevated resource pressure prior to traffic loss.
- Recovery of forwarding only after a device reboot, with no software change applied.
- Spikes of high-volume TCP/IP flows traversing the inline inspection path immediately before the outage.
Detection Strategies
- Correlate FTD connection and intrusion event logs with upstream and downstream NetFlow or sFlow records to identify unexplained drops.
- Baseline normal traffic throughput per interface and alert on rapid divergence between ingress and egress counters on FTD inspection interfaces.
- Monitor Snort engine health and process telemetry exposed by Firepower Management Center (FMC) for resource-exhaustion signatures.
Monitoring Recommendations
- Forward FTD syslog, FMC audit logs, and SNMP health data to a centralized analytics platform for correlation across devices.
- Alert on FTD reboot events that are not tied to a scheduled change window, as these may indicate operator response to a DoS condition.
- Track external scanners or sources generating abnormal TCP/IP packet rates toward perimeter interfaces protected by Snort inspection.
How to Mitigate CVE-2024-20351
Immediate Actions Required
- Identify all FTD and FirePOWER Services devices running versions in the 6.2.3 through 7.4.1.1 range using FMC inventory or device CLI.
- Apply the fixed software release identified in the Cisco Security Advisory cisco-sa-sa-ftd-snort-fw-BCJTZPMu.
- Review the corresponding Cisco ERP Alert ERP-75300 for upgrade guidance and supported migration paths.
- Restrict exposure of inspection interfaces to untrusted networks where feasible until patching is complete.
Patch Information
Cisco has released fixed software addressing CVE-2024-20351. Administrators should consult the vendor advisory cisco-sa-sa-ftd-snort-fw-BCJTZPMu for the specific fixed release that corresponds to each affected FTD train (6.2.3.x, 6.4.x, 6.6.x, 6.7.x, 7.0.x, 7.1.x, 7.2.x, 7.3.x, and 7.4.x). Upgrade planning should account for HA pair sequencing and configuration backup before applying the patch.
Workarounds
- No vendor-confirmed workaround fully eliminates the condition; upgrading to a fixed release is the required remediation.
- Apply upstream rate limiting and DDoS protections on perimeter routers or scrubbing services to reduce the likelihood of attacker-generated TCP/IP floods reaching the FTD inspection path.
- Where supported by the deployment, use access control policies to drop traffic from known abusive sources before it reaches the Snort engine.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
