Executive brief
A vulnerability exists in ciscodump, a tool included with Wireshark used to capture network traffic from Cisco devices. If a user connects the tool to a malicious or compromised Cisco device, the device can send specially crafted data that causes the tool to crash. This results in a denial of service, preventing the user from successfully capturing or analyzing network traffic from that source.
Technical details
A heap-based buffer overflow (CWE-122) exists in the ciscodump extcap capture tool's remote hex-dump parsers. The tool allocates a fixed 65,535-byte heap buffer (PACKET_MAX_SIZE) but fails to perform bounds checking when appending decoded hex groups via memcpy in the parse_line_ios, parse_line_ios_xe_16, parse_line_ios_xe_17, and parse_line_asa functions. An attacker controlling a remote Cisco device or performing a Man-in-the-Middle attack on the SSH session can stream more than 65,535 bytes of hex data for a single packet, leading to an out-of-bounds write. This results in a crash (DoS) and potentially arbitrary code execution. The issue is addressed in versions 4.6.7 and 4.4.17.
Affected products
- Wireshark Foundation ciscodump 4.6.0 to 4.6.6, 4.4.0 to 4.4.16
Timeline
- 2026-06-22: other: Vulnerability verified on master branch
- 2026-07-08: disclosed: Initial disclosure date
- 2026-07-08: advisory: NVD publication date