A logic error in memory management of the Snort 3 Detection Engine in Cisco Secure Firewall Threat Defense software could allow an unauthenticated remote attacker to cause the engine to restart. The flaw arises when the device performs Snort 3 SSL packet inspection and processes crafted SSL packets sent through an established connection. Exploitation results in a denial of service as the Snort 3 Detection Engine unexpectedly restarts, interrupting the firewall’s packet inspection capabilities. This issue corresponds to CWE‑788, insecure memory management.

The vulnerability affects Cisco Secure Firewall Threat Defense (FTD) software that includes the Snort 3 Detection Engine with SSL packet inspection enabled. Specific version information is not provided, so all deployments of the affected software are potentially vulnerable until a patch is applied.

The CVSS score of 5.8 indicates moderate risk, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. The flaw is not listed in the CISA KEV catalog. The attack requires remote, unauthenticated access to send crafted SSL packets to the firewall; no privilege escalation or local access is needed. Once exploited, the Snort 3 engine restarts, causing a service interruption that can degrade firewall performance for all traffic passing through the device.