{"id":"CVE-2026-20221","title":"Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerabilities","summary":"Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected r…","severity":"medium","cvss":5.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","cvssSource":"cna","cwe":["CWE-476"],"vendor":"Cisco","product":"Cisco Cyber Vision","affected":["cyber_vision 3.0.0","cyber_vision 3.0.2","cyber_vision 3.0.3","cyber_vision 3.0.1","cyber_vision 3.1.0","cyber_vision 3.0.4","cyber_vision 3.1.1","cyber_vision 3.1.2","cyber_vision 3.2.0","cyber_vision 3.0.5","cyber_vision 3.2.1","cyber_vision 3.0.6","cyber_vision 3.2.2","cyber_vision 3.2.3","cyber_vision 3.2.4","cyber_vision 4.0.0","cyber_vision 4.0.1","cyber_vision 4.0.2","cyber_vision 4.0.3","cyber_vision 4.1.0","cyber_vision 4.1.1","cyber_vision 4.1.2","cyber_vision 4.1.3","cyber_vision 4.1.4","cyber_vision 4.2.0","cyber_vision 4.2.1","cyber_vision 4.1.5","cyber_vision 4.2.2","cyber_vision 4.2.X","cyber_vision 4.2.3","cyber_vision 4.2.4","cyber_vision 4.2.6","cyber_vision 4.1.6","cyber_vision 4.3.0","cyber_vision 4.3.1","cyber_vision 4.3.2","cyber_vision 4.3.3","cyber_vision 4.4.0","cyber_vision 4.4.1","cyber_vision 4.4.2","cyber_vision 4.4.3","cyber_vision 4.1.7","cyber_vision 5.0.0","cyber_vision 5.0.1","cyber_vision 5.0.2","cyber_vision 5.1.0","cyber_vision 5.1.1","cyber_vision 5.1.2","cyber_vision 5.1.3","cyber_vision 5.2.0"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T16:12:53.435Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-20221","references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gre-JNpMHrTv","label":"cisco-sa-snort3-gre-JNpMHrTv"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T17:07:51.305Z","slug":"CVE-2026-20221","body":"## Overview\n\nMultiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected restart of the Snort 3 Detection Engine.\r\n\r\nThis vulnerability is due to improper handling of nested GRE traffic. An attacker could exploit this vulnerability by sending a crafted GRE payload through an affected device. A successful exploit could allow the attacker to trigger an unexpected reload of the Snort 3 Detection Engine, resulting in either a bypass or denial of service (DoS) condition, depending on device configuration. For more information, see the  section of this advisory. The Snort 3 Detection Engine will restart automatically. No manual intervention is required.\n\n## Affected\n\n- `cyber_vision 3.0.0`\n- `cyber_vision 3.0.2`\n- `cyber_vision 3.0.3`\n- `cyber_vision 3.0.1`\n- `cyber_vision 3.1.0`\n- `cyber_vision 3.0.4`\n- `cyber_vision 3.1.1`\n- `cyber_vision 3.1.2`\n- `cyber_vision 3.2.0`\n- `cyber_vision 3.0.5`\n- `cyber_vision 3.2.1`\n- `cyber_vision 3.0.6`\n- `cyber_vision 3.2.2`\n- `cyber_vision 3.2.3`\n- `cyber_vision 3.2.4`\n- `cyber_vision 4.0.0`\n- `cyber_vision 4.0.1`\n- `cyber_vision 4.0.2`\n- `cyber_vision 4.0.3`\n- `cyber_vision 4.1.0`\n- `cyber_vision 4.1.1`\n- `cyber_vision 4.1.2`\n- `cyber_vision 4.1.3`\n- `cyber_vision 4.1.4`\n- `cyber_vision 4.2.0`\n- `cyber_vision 4.2.1`\n- `cyber_vision 4.1.5`\n- `cyber_vision 4.2.2`\n- `cyber_vision 4.2.X`\n- `cyber_vision 4.2.3`\n- `cyber_vision 4.2.4`\n- `cyber_vision 4.2.6`\n- `cyber_vision 4.1.6`\n- `cyber_vision 4.3.0`\n- `cyber_vision 4.3.1`\n- `cyber_vision 4.3.2`\n- `cyber_vision 4.3.3`\n- `cyber_vision 4.4.0`\n- `cyber_vision 4.4.1`\n- `cyber_vision 4.4.2`\n- `cyber_vision 4.4.3`\n- `cyber_vision 4.1.7`\n- `cyber_vision 5.0.0`\n- `cyber_vision 5.0.1`\n- `cyber_vision 5.0.2`\n- `cyber_vision 5.1.0`\n- `cyber_vision 5.1.1`\n- `cyber_vision 5.1.2`\n- `cyber_vision 5.1.3`\n- `cyber_vision 5.2.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":31.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}