ETTERCAP · CVE-2026-125404 · Other
NO FIX YET · SEE WHAT TO DO
Ettercap through 0.8.4.1 subtracts the 8-byte CCMP trailer from a frame without checking its length, an integer underflow in ccmp_decrypt(). An attacker on the same wireless network, with its WPA key loaded, can send a short crafted frame to overflow a stack buffer in Ettercap, which normally runs as root.
first public Nov 6, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only machines that run Ettercap against a WPA-protected wireless network whose key is loaded are exposed, since the attacker must be on that network and the bug is in CCMP decryption. Systems that do not run Ettercap, or that do not use it on WPA networks, can skip it. Sources do not state a fixed version.
Not affected if no-ettercap-installed, no-wifi-sniffing, no-wpa-key-configured, no-wpa-key-loaded
Who cares ettercap, network-auditing, wireless
Ettercap through 0.8.4.1 contains an integer underflow in ccmp_decrypt() in src/ec_encryption_ccmp.c that subtracts the 8-byte CCMP trailer without checking minimum length. Attackers on a network whose WPA key is loaded can send a short crafted CCMP frame to overflow a stack buffer in the Ettercap process, which normally runs as root.
This page as .md · .json · CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
0.8.4.1NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.