CVE-2021-40114
MediumCVSS 6.8Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
A vulnerability in the Snort detection engine of multiple Cisco products when processing ICMP traffic could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The issue is due to improper memory resource management while processing ICMP packets. An attacker could send a series of ICMP packets through an affected device, potentially exhausting resources and causing a reload.
Risk Assessment
The risk is that an attacker can disrupt device operation, leading to unavailability of network services.
Recommendation
It is recommended to upgrade to a patched version and limit exposure to ICMP traffic if possible.
Original NVD description (English source)
Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper memory resource management while the Snort detection engine is processing ICMP packets. An attacker could exploit this vulnerability by sending a series of ICMP packets through an affected device. A successful exploit could allow the attacker to exhaust resources on the affected device, causing the device to reload.