CVE-2021-1224 - Vulnerability Details

Description

Multiple Cisco products are affected by a vulnerability with TCP Fast Open (TFO) when used in conjunction with the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect detection of the HTTP payload if it is contained at least partially within the TFO connection handshake. An attacker could exploit this vulnerability by sending crafted TFO packets with an HTTP payload through an affected device. A successful exploit could allow the attacker to bypass configured file policy for HTTP packets and deliver a malicious payload.

Published: 2021-01-13

Score: 5.8 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Cisco

Cisco Firepower Threat Defense Software

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:cisco:firepower_threat_defense::::::::
	cpe:2.3:a:cisco:secure_firewall_management_center:2.9.14.0:::::::*
	cpe:2.3:a:cisco:secure_firewall_management_center:2.9.15:::::::*
	cpe:2.3:a:cisco:secure_firewall_management_center:2.9.16:::::::*
	cpe:2.3:a:cisco:secure_firewall_management_center:2.9.17:::::::*
	cpe:2.3:a:cisco:secure_firewall_management_center:2.9.18:::::::*
	cpe:2.3:a:cisco:secure_firewall_management_center:3.0.1:::::::*

Configuration 2 [-]

AND

cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:1109-2p_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:1109-4p_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:1111x-8p_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:4221_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:4321_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:4331_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:4351_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:4431_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:4451-x_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:4461_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:csr_1000v:-:::::::*
	cpe:2.3:h:cisco:isa_3000:-:::::::*

Configuration 3 [-]

cpe:2.3:a:snort:snort:*:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:cisco:meraki_mx64_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx64:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:cisco:meraki_mx64w_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx64w:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:cisco:meraki_mx67_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx67:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:cisco:meraki_mx67c_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx67c:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:cisco:meraki_mx67w_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx67w:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND

cpe:2.3:o:cisco:meraki_mx68_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx68:-:*:*:*:*:*:*:*

Configuration 10 [-]

AND

cpe:2.3:o:cisco:meraki_mx68cw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx68cw:-:*:*:*:*:*:*:*

Configuration 11 [-]

AND

cpe:2.3:o:cisco:meraki_mx68w_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx68w:-:*:*:*:*:*:*:*

Configuration 12 [-]

AND

cpe:2.3:o:cisco:meraki_mx100_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx100:-:*:*:*:*:*:*:*

Configuration 13 [-]

AND

cpe:2.3:o:cisco:meraki_mx84_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx84:-:*:*:*:*:*:*:*

Configuration 14 [-]

AND

cpe:2.3:o:cisco:meraki_mx250_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx250:-:*:*:*:*:*:*:*

Configuration 15 [-]

AND

cpe:2.3:o:cisco:meraki_mx450_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx450:-:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-3317-1	snort security update
Debian DSA	DSA-5354-1	snort security update
EUVD	EUVD-2021-6691	Multiple Cisco products are affected by a vulnerability with TCP Fast Open (TFO) when used in conjunction with the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect detection of the HTTP payload if it is contained at least partially within the TFO connection handshake. An attacker could exploit this vulnerability by sending crafted TFO packets with an HTTP payload through an affected device. A successful exploit could allow the attacker to bypass configured file policy for HTTP packets and deliver a malicious payload.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00476.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://lists.debian.org/debian-lts-announce/2023/02/msg00011.html
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-tfo-bypass-MmzZrtes
https://www.debian.org/security/2023/dsa-5354

History

Tue, 24 Feb 2026 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 14 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00443}`	epss `{'score': 0.00486}`

Tue, 26 Nov 2024 16:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Cisco secure Firewall Management Center
CPEs	cpe:2.3:a:cisco:firepower_management_center:2.9.14.0:::::::* cpe:2.3:a:cisco:firepower_management_center:2.9.15:::::::* cpe:2.3:a:cisco:firepower_management_center:2.9.16:::::::* cpe:2.3:a:cisco:firepower_management_center:2.9.17:::::::* cpe:2.3:a:cisco:firepower_management_center:2.9.18:::::::* cpe:2.3:a:cisco:firepower_management_center:3.0.1:::::::*	cpe:2.3:a:cisco:secure_firewall_management_center:2.9.14.0:::::::* cpe:2.3:a:cisco:secure_firewall_management_center:2.9.15:::::::* cpe:2.3:a:cisco:secure_firewall_management_center:2.9.16:::::::* cpe:2.3:a:cisco:secure_firewall_management_center:2.9.17:::::::* cpe:2.3:a:cisco:secure_firewall_management_center:2.9.18:::::::* cpe:2.3:a:cisco:secure_firewall_management_center:3.0.1:::::::*
Vendors & Products	Cisco firepower Management Center	Cisco secure Firewall Management Center

Subscriptions

Cisco 1100-4p Integrated Services Router 1100-8p Integrated Services Router 1101-4p Integrated Services Router 1109-2p Integrated Services Router 1109-4p Integrated Services Router 1111x-8p Integrated Services Router 4221 Integrated Services Router 4321 Integrated Services Router 4331 Integrated Services Router 4351 Integrated Services Router 4431 Integrated Services Router 4451-x Integrated Services Router 4461 Integrated Services Router Csr 1000v Firepower Threat Defense Ios Xe Isa 3000 Meraki Mx100 Meraki Mx100 Firmware Meraki Mx250 Meraki Mx250 Firmware Meraki Mx450 Meraki Mx450 Firmware Meraki Mx64 Meraki Mx64 Firmware Meraki Mx64w Meraki Mx64w Firmware Meraki Mx67 Meraki Mx67 Firmware Meraki Mx67c Meraki Mx67c Firmware Meraki Mx67w Meraki Mx67w Firmware Meraki Mx68 Meraki Mx68 Firmware Meraki Mx68cw Meraki Mx68cw Firmware Meraki Mx68w Meraki Mx68w Firmware Meraki Mx84 Meraki Mx84 Firmware Secure Firewall Management Center

Snort Snort

MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2021-01-13T21:16:53.450Z

Updated: 2024-11-12T20:48:38.628Z

Reserved: 2020-11-13T00:00:00.000Z

Link: CVE-2021-1224

Vulnrichment

Updated: 2024-08-03T16:02:56.126Z

NVD

Status : Modified

Published: 2021-01-13T22:15:20.410

Modified: 2024-11-26T16:09:02.407

Link: CVE-2021-1224

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object