CVE-2024-20363: Cisco Secure Firewall Auth Bypass Vulnerability

CVE-2024-20363 Overview

CVE-2024-20363 is an authentication bypass vulnerability in the Snort Intrusion Prevention System (IPS) rule engine used by multiple Cisco products. The flaw stems from incorrect HTTP packet handling within the Snort 3 detection engine. An unauthenticated, remote attacker can send crafted HTTP packets through an affected device to bypass configured IPS rules. Successful exploitation allows uninspected traffic to traverse the network, defeating the policy enforcement that defenders rely on.

Critical Impact
Attackers can route malicious HTTP traffic past Snort 3 IPS inspection, nullifying signature-based detection and allowing downstream exploitation of protected assets without triggering alerts.

Affected Products

Cisco Secure Firewall Threat Defense 7.4.0
Cisco Unified Threat Defense Snort IPS Engine (versions 17.6.4, 17.6.5, 17.12.1a, 17.12.2)
Cisco Snort

Discovery Timeline

2024-05-22 - CVE-2024-20363 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2024-20363

Vulnerability Analysis

The vulnerability resides in the Snort 3 IPS rule engine that powers inspection on Cisco Secure Firewall Threat Defense and Unified Threat Defense deployments. The engine fails to correctly process certain HTTP packet structures, causing it to skip rule evaluation on specific traffic flows. Because the IPS silently forwards the malformed traffic, no detection events are generated for the bypass itself.

The weakness is categorized under [CWE-290: Authentication Bypass by Spoofing], reflecting the way crafted HTTP packets masquerade as traffic the engine does not need to inspect. The flaw affects integrity of the security control rather than confidentiality or availability, which aligns with the scope-change rating assigned by Cisco.

Root Cause

The root cause is improper handling of HTTP packet attributes within the Snort 3 detection pipeline. When specific packet characteristics are present, the engine's HTTP inspector fails to normalize or classify the stream correctly, which causes the rule matcher to omit evaluation. Rules configured on the device remain in place, but the offending traffic never reaches them.

Attack Vector

Exploitation requires no authentication, no user interaction, and only network access to a path that transits the affected device. An attacker constructs HTTP packets with the triggering characteristics and sends them through the firewall or IPS. The device forwards the traffic without applying the configured signature set, allowing follow-on payloads (such as web exploits or command-and-control traffic) to reach internal systems unobserved.

No verified public proof-of-concept code is available. Technical specifics are limited to the vendor advisory. See the Cisco Security Advisory: Snort3 IPS Bypass for additional detail.

Detection Methods for CVE-2024-20363

Indicators of Compromise

Absence of expected IPS events for HTTP sessions that should have matched active rules, particularly against public-facing web assets.
Successful inbound HTTP exchanges to internal hosts despite policy that should block or alert on the observed URIs or payloads.
Discrepancies between firewall flow logs and IPS inspection logs for the same five-tuple sessions.

Detection Strategies

Correlate network flow records with Snort 3 event logs to identify HTTP sessions traversing the device without a corresponding inspection verdict.
Deploy out-of-band packet capture or a second inspection layer on egress and compare detections against the primary Snort 3 engine.
Hunt for anomalous HTTP header structures and non-conformant request framing on sessions that reached protected servers.

Monitoring Recommendations

Enable verbose connection event logging on Cisco Secure Firewall Threat Defense and forward it to a centralized analytics platform for correlation.
Baseline the volume of IPS verdicts per policy and alert on sudden drops that may indicate bypass conditions.
Monitor Cisco PSIRT advisories for updated indicators and detection content tied to this advisory ID.

How to Mitigate CVE-2024-20363

Immediate Actions Required

Inventory all Cisco Secure Firewall Threat Defense and Unified Threat Defense devices running Snort 3 and identify versions matching the affected list.
Apply the fixed software releases documented in the Cisco Security Advisory for Snort 3 IPS Bypass.
Review IPS policies to confirm Snort 3 is the active engine, as the bypass is specific to Snort 3 deployments.

Patch Information

Cisco has released fixed software versions addressing CVE-2024-20363. Refer to the Cisco Security Advisory: Snort3 IPS Bypass for the authoritative list of patched releases and upgrade guidance. No workaround is provided by Cisco; upgrading is the required remediation path.

Workarounds

Switch the inspection engine from Snort 3 to Snort 2 where operationally feasible, as the vulnerability is specific to the Snort 3 implementation.
Add compensating controls at adjacent layers, such as web application firewall inspection in front of exposed HTTP services.
Restrict exposure of HTTP-facing assets behind the affected device until the upgrade can be deployed.

bash

# Verify Snort engine version on Cisco Secure Firewall Threat Defense
> show snort3 status
> show version | include Snort

# After upgrade, confirm the device no longer reports an affected release
> show version