CVE-2022-20922

CVE-2022-20922 describes multiple vulnerabilities in the Snort detection engine's SMB2 processor, affecting Cisco Cyber Vision, Firepower Threat Defense, and Umbrella Insights Virtual Appliance when configured with Snort 3. These flaws stem from improper resource management during SMB2 traffic processing. An unauthenticated, remote attacker can exploit this by sending a high rate of specific SMB2 packets, leading to a denial of service (DoS) condition by triggering a Snort process reload. If the "snort preserve-connection" option is enabled (which is default), policy bypass and malicious payload delivery are also possible. The vulnerability has a CVSS score of 6.5 (Medium), indicating network attack vector, low attack complexity, and potential for limited integrity and availability impact. There is currently no evidence of active exploitation, public exploit code, or significant community discussion.