CVE-2022-20685

CVE-2022-20685 is an integer overflow vulnerability in the Modbus preprocessor of the Snort detection engine, affecting Cisco Cyber Vision, Firepower Threat Defense, and Unified Threat Defense Snort IPS Engine. An unauthenticated, remote attacker can exploit this by sending crafted Modbus traffic, leading to a denial of service (DoS) condition where the Snort process hangs and traffic inspection ceases. With a CVSS score of 7.5 (High), this vulnerability has a network attack vector and low attack complexity, requiring no user interaction. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in CISA's KEV catalog. However, it has garnered moderate community discussion and media coverage.