A vulnerability in the detection engine reassembly of HTTP packets for Cisco Firepower System Software before 6.0.1 could allow an unauthen…

Published 10 y ago 2016-10-27 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.5

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.6%

percentile 76%

Public exploits

none known

A vulnerability in the detection engine reassembly of HTTP packets for Cisco Firepower System Software before 6.0.1 could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to the Snort process unexpectedly restarting. The vulnerability is due to improper handling of an HTTP packet stream. An attacker could exploit this vulnerability by sending a crafted HTTP packet stream to the detection engine on the targeted device. An exploit could allow the attacker to cause a DoS condition if the Snort process restarts and traffic inspection is bypassed or traffic is dropped.

Exploit prediction (EPSS)

1.63% probability of exploitation in the next 30 days, higher than 76% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:N/A:P`

Affected products

n/a Cisco Firepower System Software before 6.0.1

Classification

Weakness

CWE-399 Resource Management Errors

References

tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20161019-fpsnort · x_refsource_CONFIRM, x_transferred
securitytracker.com /id/1037061 · vdb-entry, x_refsource_SECTRACK, x_transferred
securityfocus.com /bid/93787 · vdb-entry, x_refsource_BID, x_transferred

Sources

CVE List: CVE-2016-6439
NVD: CVE-2016-6439

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.