CVE-2021-40114
MediumCVSS 6.8Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
A vulnerability in the Snort detection engine of multiple Cisco products when processing ICMP traffic could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The issue is due to improper memory resource management while processing ICMP packets. An attacker could send a series of ICMP packets through an affected device, potentially exhausting resources and causing a reload.
Risk Assessment
The risk is that an attacker can disrupt device operation, leading to unavailability of network services.
Recommendation
It is recommended to upgrade to a patched version and limit exposure to ICMP traffic if possible.
Other vulnerabilities in Snort
See all- CVE-2016-1417High
The vulnerability in Snort 2.9.7.0-WIN32 related to an untrusted search path allows remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a malicious tcapi.dll file located in the same folder as a processed pcap file.
- CVE-2026-20043Critical
A vulnerability in Cisco Snort 3 software related to out-of-bounds writes (CWE-787). It was discovered during an internal security review and fixed in hardening releases.
- CVE-2026-76524High
The Snort 3 control channel socket implementation lacks authentication when a local user connects to the socket. An authenticated local attacker with low privileges can execute arbitrary commands as the Snort 3 process user and read or write the process memory.
- CVE-2026-76489Medium
Multiple Cisco products are affected by a vulnerability in the memory management implementation of Snort 3 that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The issue is due to incomplete error checking when Snort 3 processes files, which could cause unreleased memory.
- CVE-2026-20356High
Cisco Snort 3 contains multiple internally discovered vulnerabilities related to uncontrolled resource consumption (CWE-400) that have been addressed in software hardening releases. Technical details of individual cases were not disclosed in the description.
- CVE-2026-20291High
Cisco's Open Source Snort 3 software engineering team conducted an internal security review, resulting in hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20291 relate to improper privilege management (CWE-269).
- CVE-2026-20236High
Cisco Snort 3 contains multiple internally discovered vulnerabilities related to incorrect calculation (CWE-682) that have been addressed in software hardening releases. Technical details of individual cases were not disclosed in the description.
- CVE-2026-20218Medium
A vulnerability in the Snort 3 VBA Decompression Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS). The flaw is due to improper range checking when decompressing user-controlled VBA data. Sending crafted VBA data can cause a stack overflow and DoS condition.
- CVE-2026-20197Medium
A vulnerability in the Snort 3 Teredo Detection Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The flaw is due to incomplete error checking when parsing Teredo packets. Sending a crafted Teredo packet to a targeted device can cause an unexpected restart and DoS condition.
- CVE-2026-20179Medium
A vulnerability in the Snort 3 Generic Routing Encapsulation (GRE) Detection Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The flaw is due to incomplete error checking when parsing GRE packets. Sending a crafted GRE packet to a targeted device can cause an unexpected restart and DoS condition.
Original NVD description (English source)
Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper memory resource management while the Snort detection engine is processing ICMP packets. An attacker could exploit this vulnerability by sending a series of ICMP packets through an affected device. A successful exploit could allow the attacker to exhaust resources on the affected device, causing the device to reload.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS