Blinding Snort IDS/IPS: Breaking the Modbus OT Preprocessor

Team82 discovered CVE-2022-20685, an integer-overflow vulnerability in the Snort Modbus OT preprocessor that can be exploited remotely to trigger an infinite while-loop, causing a denial-of-service that prevents Snort from processing packets or generating alerts; the issue affects open-source Snort releases earlier than 2.9.19 and 3.1.11.0, has a CVSSv3 score of 7.5 (CWE-190), and has been patched by Cisco and the Snort team.