SecBoard
Zurück zur CVE-Übersicht

CVE-2026-20290

MEDIUM(5.8)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Risk Signal Score25/100 — MITTEL
  • CVSS 5.8 — Mittel
  • Weniger als 24 Stunden alt

Erwähnungen (letzte 60 Tage)

Artikel

Beschreibung

A vulnerability in SSL/TLS certificate parsing in the Snort 2 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 2 Detection Engine to restart. This vulnerability is due to incomplete validation of the SSL certificate. An attacker could exploit this vulnerability by sending a crafted SSL connection setup request to be parsed by Snort 2. A successful exploit could allow the attacker to cause the Snort 2 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Detection of crafted SSL connection setup requests causing Snort 2 restarts. This requires monitoring Snort 2 engine status and correlating with incoming SSL/TLS traffic.

Sentinel/Defender KQL

// Monitor Snort 2 engine restarts and correlate with SSL/TLS connection attempts
DeviceProcessEvents
| where FileName contains "snort" and ProcessCommandLine contains "restart"
| join kind=inner (DeviceNetworkEvents
| where RemotePort == 443 or LocalPort == 443
| summarize count() by DeviceId, bin(Timestamp, 5m))
on DeviceId
| where Timestamp between (Timestamp - 5m .. Timestamp + 5m)
| project Timestamp, DeviceName, FileName, ProcessCommandLine, RemoteIP, RemotePort

Splunk SPL

// Monitor Snort 2 engine restarts and correlate with SSL/TLS connection attempts
(index=* OR index=main) (sourcetype=*snort* OR sourcetype=*syslog*)
| rex field=_raw "snort.*(restart|stopped|started)"
| eval snort_event_time = _time
| join type=inner max=0 (search (index=* OR index=main) (sourcetype=*network* OR sourcetype=*firewall*)
| where dest_port=443 OR src_port=443
| eval network_event_time = _time)
| where network_event_time >= (snort_event_time - 300) AND network_event_time <= (snort_event_time + 300)
| table _time, host, snort_event_time, network_event_time, src_ip, dest_ip, dest_port, _raw

Sigma

title: Cisco FTD Snort 2 SSL DoS Vulnerability
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential exploitation of CVE-2026-20290 by monitoring Snort 2 restarts correlated with SSL/TLS traffic.
author: SecBoard
date: 2026/09/16
logsource:
  category: process_creation
  product: windows
  service: snort
detection:
  selection_snort_restart:
    Image|endswith: '\snort.exe'
    CommandLine|contains: 'restart'
  selection_network_ssl:
    EventID: 3
    DestinationPort: 443
  condition: selection_snort_restart and selection_network_ssl
  timeframe: 5m
level: high

Elastic ES|QL

// Monitor Snort 2 engine restarts and correlate with SSL/TLS connection attempts
from process where process.executable : "*snort*" and process.command_line : "*restart*"
| join (from network where destination.port == 443 or source.port == 443)
  on @timestamp within 5m
| select @timestamp, host.name, process.executable, process.command_line, destination.ip, destination.port

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen