Executive brief
Keysight IxChariot Endpoint and related products are network performance testing tools used to measure and validate network performance in enterprise environments. An unauthenticated attacker can send a specially crafted network packet to trigger a stack buffer overflow, allowing remote code execution with administrative privileges. This could allow an attacker to take complete control of affected systems and compromise network infrastructure.
Technical details
The vulnerability is a stack-based buffer overflow in Keysight IxChariot Endpoint and associated products (Hawkeye, IxTap, IxByPass, and IxProbe). An unauthenticated remote attacker can send a specially crafted packet to trigger the overflow condition and execute arbitrary code with administrative privileges. The attack requires network reachability to the affected endpoint but no authentication or user interaction. Patches are available; affected versions should be upgraded to IxChariot 9.5.102 or 10.0.254 (or later), Hawkeye 6.0.7 (or later), and IxByPass 3.13.0.69 (or later).
Affected products
- Keysight IxChariot Endpoint <9.5.102, <10.0.254
- Keysight Hawkeye <6.0.7
- Keysight IxTap <UNKNOWN>
- Keysight IxByPass <3.13.0.69
- Keysight IxProbe <UNKNOWN>
Timeline
- 2026-08-04: disclosed: CISA advisory VA-26-216-01 published