Cisco Security Updates – 23 May 2024

The addressed vulnerabilities could allow the attacker to bypass security restrictions, conduct denial of service attacks, or manipulate data to view, add, modify, or delete information by sending specially crafted SQL statements to the affected product.

Sample of the addressed vulnerabilities:

1. Cisco Firepower Management Center Software SQL Injection Vulnerability (CVE-2024-20360):

• CVSS: 8.8
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Consequences: Data Manipulation

2. Multiple Cisco Products Snort 3 HTTP Intrusion Prevention System Rule Security Bypass (CVE-2024-20363):

• CVSS: 5.8
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Bypass Security

Sample of the affected products:

• Cisco Cisco Firepower Management Center.
• Cisco Adaptive Security Appliance (ASA) Software.
• Cisco Firepower Threat Defense Software.
• Cisco UTD SNORT IPS Engine Software.