DEV Community

StarkMan
StarkMan

Posted on

4,802 Firepower fingerprints, 985 IOS XE and zero Cyber Vision: reading three Snort 3 numbers together

#zoomeye #snort3 #cisco #exposuremeasurement

4,802 Firepower fingerprints, 985 IOS XE and zero Cyber Vision: reading three Snort 3 numbers together

Cisco's 21 October 2026 release fixed 13 Snort 3 vulnerabilities across seven advisories. The engine sits inside several products, and a ZoomEye measurement of three of them on 22 October produced a result that needs explaining before it is quoted.

The three measurements

Query Matches Collected (UTC)
app="Cisco Firepower Threat Defense" 4,802 22 Oct 2026, 05:36
app="Cisco IOS XE" 985 22 Oct 2026, 05:37
app="Cisco Cyber Vision" 0 22 Oct 2026, 05:36

Search links appear in the references. The units differ in meaning. The first two are fingerprint matches for products that commonly answer on a network interface. The third is zero matches, and zero is not a deployment figure.

Why zero does not mean nobody runs Cyber Vision

Cyber Vision is an industrial visibility product deployed to observe operational technology networks. Those deployments sit inside plant networks, not on the public internet. A fingerprint query returns zero because the product is not exposed where a scanner can see it, not because the install base is empty.
The distinction generalises, and this is the most common misreading of exposure data. A zero result has at least four possible causes: the product is genuinely absent, the product is present but unreachable, ZoomEye has no fingerprint for it, or the fingerprint exists but the query string does not match it. Only the first is a deployment statement. The second is normal for control-plane and internal tooling. The third and fourth are measurement limits that a second candidate query can partly resolve.
Testing a second candidate is cheap and worth doing before publishing any number. In this run, an earlier query for app="Cisco Unified CM" returned zero while app="Cisco Unified Communications Manager" returned 5,002, which shows the same product can produce a zero and a five-thousand result depending on the string.

What the 4,802 and 985 counts do support

Both figures describe products that need fixing, and the split between them is the useful part.
Secure Firewall Threat Defense is a dedicated appliance, and the fixed releases are 7.2.12, 7.4.8, 7.6.6, 7.7.13 and 10.0.2. IOS XE devices carrying Unified Threat Defense are routers, and their fixed releases are 17.12.8, 17.15.6, 17.18.5, 26.1.2 and 26.2.1. Those are different maintenance programmes, different change boards and usually different teams.
A count of 4,802 against 985 does not establish a ratio of vulnerable appliances to vulnerable routers, because the two fingerprints describe different populations with different visibility. It does establish that both surfaces are internet-visible in material numbers, which weakens the assumption that intrusion prevention engines live only in the network core.

The fail-open question that no count answers

The engine restart behaviour is the operational risk in this advisory set. When Snort 3 restarts, inspection stops for a moment, and depending on the fail-open setting the traffic may pass uninspected or be dropped.
No external query can see that setting. Whether a visible firewall represents a blind spot or an outage during a restart depends on a local configuration choice, and the same 4,802 figure covers both cases without distinction.

How to use this measurement inside an organisation

  1. Run the same three queries, then match results against your own asset inventory. The external count establishes that exposure is common, and the match establishes which records are yours.
  2. Separate FTD, IOS XE with UTD and Cyber Vision into three upgrade tracks, because the fixed release lists do not overlap.
  3. Check fail-open settings before the patch window rather than during it.
  4. Confirm that online Meraki MX appliances received Cisco's automatic update, since that platform does not appear in this fingerprint set at all and is handled outside it.
  5. For cloud-delivered Firewall and Secure Access, no action is needed because Cisco updated those services on 21 October.

Where the reporting is explicit about limits

Cisco has not described the individual hardening bugs and says it may publish separate advisories later, so the mechanism behind CVE-2026-20043 remains unpublished. None of the 13 CVEs appears in CISA's known exploited vulnerabilities catalog, and no public proof of concept has been confirmed.
The exposure data adds its own limits. Fingerprints identify products rather than versions, so no query in this set reports which fixed release a host runs. Zero Cyber Vision matches is a visibility result, not a market result.

References

Top comments (0)