Secure Firewall ASA and FTD
CVE-2022-20685: Multiple Cisco Products Snort Modbus Denial of Service Vulnerability
A vulnerability in the Modbus preprocessor of the Snort detection engine could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
Published
ExploitedNot in CISA KEV
Ransomware useNot reportedPer CISA
SeverityHIGHCVSS 3.1 7.5
EPSS1.5%Chance of exploitation in 30 days
Public exploitNot tracked
FixNot yet
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Cisco Cyber Vision 3.0 | See the advisory |
| Cisco Cyber Vision 3.0 | See the advisory |
| Cisco Cyber Vision 3.0 | See the advisory |
| Cisco Cyber Vision 3.0 | See the advisory |
| Cisco Cyber Vision 3.1 | See the advisory |
| Cisco Cyber Vision 3.0 | See the advisory |
| Cisco Cyber Vision 3.1 | See the advisory |
| Cisco Cyber Vision 3.1 | See the advisory |
| Cisco Cyber Vision 3.2 | See the advisory |
| Cisco Cyber Vision 3.0 | See the advisory |
| Cisco Cyber Vision 3.2 | See the advisory |
| Cisco Cyber Vision 3.0 | See the advisory |
| Cisco Cyber Vision 3.2 | See the advisory |
| Cisco Cyber Vision 3.2 | See the advisory |
| Cisco Cyber Vision 3.2 | See the advisory |
| Cisco Cyber Vision 4.0 | See the advisory |
| Cisco Cyber Vision 4.0 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.6 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.6 | See the advisory |
| Cisco Firepower Threat Defense Software 6.6 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.7 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.6 | See the advisory |
| Cisco Firepower Threat Defense Software 6.7 | See the advisory |
| Cisco Firepower Threat Defense Software 6.6 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.7 | See the advisory |
| Cisco Firepower Threat Defense Software 7.0 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 7.0 | See the advisory |
| Cisco Firepower Threat Defense Software 6.6 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.7 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 3.17 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 16.12 | See the advisory |
| Cisco UTD SNORT IPS Engine Software Fuji-16.9 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 16.12 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 17.3 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 16.6 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 16.12 | See the advisory |
| Cisco UTD SNORT IPS Engine Software Fuji-16.9 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 3.17 | See the advisory |
| Cisco UTD SNORT IPS Engine Software Fuji-16.9 | See the advisory |
| Cisco UTD SNORT IPS Engine Software Denali-16.3 | See the advisory |
| Cisco UTD SNORT IPS Engine Software Fuji-16.9 | See the advisory |
| Cisco UTD SNORT IPS Engine Software Fuji-16.9 | See the advisory |
| Cisco UTD SNORT IPS Engine Software Everest-16.6 | See the advisory |
| Cisco UTD SNORT IPS Engine Software Everest-16.6 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 16.6 | See the advisory |
| Cisco UTD SNORT IPS Engine Software Denali-16.3 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 17.2 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 17.1 | See the advisory |
| Cisco UTD SNORT IPS Engine Software Everest-16.6 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 16.6 | See the advisory |
| Cisco UTD SNORT IPS Engine Software Denali-16.3 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 16.6 | See the advisory |
| Cisco UTD SNORT IPS Engine Software Denali-16.3 | See the advisory |
| Cisco UTD SNORT IPS Engine Software Denali-16.3 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 16.12 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 17.3 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 17.4 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 16.12 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 17.5 | See the advisory |
| Cisco UTD SNORT IPS Engine Software Fuji-16.9 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 16.6 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 17.3 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 17.5 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 17.3 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 17.3 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 17.4 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 17.4 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 17.6 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 16.6 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 17.7 | See the advisory |
| Cisco UTD SNORT IPS Engine Software 16.12 | See the advisory |
| Cisco UTD SNORT IPS Engine Software Fuji-16.9 | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A vulnerability in the Modbus preprocessor of the Snort detection engine could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an integer overflow while processing Modbus traffic. An attacker could exploit this vulnerability by sending crafted Modbus traffic through an affected device. A successful exploit could allow the attacker to cause the Snort process to hang, causing traffic inspection to stop.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Exploitation
The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 11 Oct 2026.