The vulnerability lies in the Snort 3 Detection Engine’s handling of SSL handshake ingress packets. A malicious actor can send specially crafted SSL handshake packets that the engine fails to parse correctly, causing the engine to restart. This restart interrupts packet inspection, resulting in a denial of service to network traffic processed by the affected Cisco products. The weakness is classified as CWE‑392, an improper shutdown or failure to properly terminate a process.

Affected products include Cisco Cyber Vision, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD SNORT IPS Engine Software. No specific version details are provided in the CNA data, so all deployments of these products potentially expose the flaw.

The CVSS score of 5.8 indicates moderate severity, while the EPSS score of less than 1% suggests a very low exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog, and no official exploitation proof of concept is reported. The likely attack vector is remote, unauthenticated traffic targeting the Snort 3 engine over a network connection. Because the flaw can be triggered without authentication, any system reachable by the attacker that runs a vulnerable instance could suffer a service interruption.