Multiple Cisco products contain a vulnerability in the Snort 3 Teredo Detection Engine that allows an unauthenticated, remote attacker to send a specially crafted Teredo packet. The incomplete error checking used when parsing the packet can cause the Snort 3 Detection Engine to crash and restart, resulting in a denial‑of‑service condition for the IDS layer. The weakness is coded as a buffer bound violation (CWE‑119) and interrupts packet inspection services.

Affected vendors and products include Cisco Open Source Snort3, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD SNORT IPS Engine Software. No specific vulnerable versions are listed in the advisory; all recent releases should be checked against Cisco’s published patches.

The CVSS base score is 5.8, indicating moderate severity and a moderate likelihood of exploitation. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of active exploitation. The likely attack vector is over the network from an unauthenticated remote source; an attacker simply needs to deliver a malformed Teredo packet to a device running an affected Snort 3 engine. Successful exploitation will only cause a local DoS on the IDS, but could degrade overall firewall or IPS performance.