Integer Underflow Vulnerability in Ettercap Affects WPA CCMP Decryption
CVE-2026-125404
7.7HIGH
What is CVE-2026-125404?
Ettercap versions up to 0.8.4.1 are susceptible to an integer underflow in the ccmp_decrypt() function. This vulnerability occurs when the calculation for processing the 8-byte CCMP trailer fails to validate the minimum length, resulting in a potential stack buffer overflow. Attackers on a local network, where the WPA key is accessible, can exploit this weakness by sending a crafted CCMP frame that leads to an overflow of the stack buffer within the Ettercap process, which typically runs with elevated root privileges. This poses significant security risks, allowing malicious actors to manipulate network traffic.
Affected Version(s)
ettercap 0 <= 0.8.4.1
References
CVSS V4
Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Adiel Sol, Arad Inbar, Erez Cohen, Nir Somech, Ben Grinberg, Daniel Lubel, Shir Sadon (DREAM Security Research Team)
Emilio Escobar