The vulnerability stems from improper handling of nested GRE traffic within the Snort 3 Detection Engine’s decapsulation routine. An unauthenticated, remote attacker can send a crafted GRE packet that forces the engine to reload automatically, producing an immediate service interruption or, depending on device configuration, a potential bypass of security checks. This weakness corresponds to a null‑pointer misuse marked as CWE‑476.

Affected Cisco products include Cisco Cyber Vision, Cisco Open Source Snort3, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco UTD SNORT IPS Engine Software, and Cisco Umbrella Insights Virtual Appliance. No version information is supplied, so any supported version of these products could be impacted.

The CVSS score of 5.8 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because no authentication is required and the exploit can be launched remotely via GRE traffic, the risk of an attacker triggering an engine reload is considered moderate; however, the exact likelihood cannot be quantified due to missing EPSS data. The impact of a successful exploit is immediate loss of Snort 3 protection and potential downstream exploitation while the engine is restarting.