{"id":"CVE-2026-125404","kind":"vulnerability","aliases":["CVE-2026-125404"],"related":[],"title":"Ettercap: short CCMP frame underflow overflows stack buffer, root process","description":"Ettercap through 0.8.4.1 contains an integer underflow in ccmp_decrypt() in src/ec_encryption_ccmp.c that subtracts the 8-byte CCMP trailer without checking minimum length. Attackers on a network whose WPA key is loaded can send a short crafted CCMP frame to overflow a stack buffer in the Ettercap process, which normally runs as root.","summary":"Ettercap through 0.8.4.1 subtracts the 8-byte CCMP trailer from a frame without checking its length, an integer underflow in ccmp_decrypt(). An attacker on the same wireless network, with its WPA key loaded, can send a short crafted frame to overflow a stack buffer in Ettercap, which normally runs as root.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ettercap","fixed":[],"affected":"<= 0.8.4.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["ettercap","network-auditing","other","wireless"],"not_affected_if":["no-ettercap-installed","no-wifi-sniffing","no-wpa-key-configured","no-wpa-key-loaded"],"how_to_check":"- Run ettercap --version: 0.8.4.1 and earlier are affected, and no release is fixed yet.\n- Only exposed if Ettercap sniffs 802.11 in monitor mode with a WPA2/CCMP key configured (-W) and the 4-way handshake observed.\n- A source build is fixed only if it includes commit 1d8badb713579419a29a494bb463a1af59707e98.","fix":"No released version yet (advisory lists patched versions: None). Fix is merged on master in commit 1d8badb (PR #1330); build from master after that commit or wait for a release newer than 0.8.4.1.","status":"open","published_at":"2026-11-10T00:17:15+00:00","first_seen_at":"2026-11-10T00:28:45+00:00","triaged_at":"2026-11-10T00:30:03+00:00","updated_at":"2026-11-10T00:31:08+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-10T00:30:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Ettercap: short CCMP frame underflow overflows stack buffer, root process","impact":"high","summary":"Ettercap through 0.8.4.1 subtracts the 8-byte CCMP trailer from a frame without checking its length, an integer underflow in ccmp_decrypt(). An attacker on the same wireless network, with its WPA key loaded, can send a short crafted frame to overflow a stack buffer in Ettercap, which normally runs as root.","audience":"developers","category":"other","nicknames":[],"who_cares":["ettercap","network-auditing","wireless"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs code as root on the Ettercap host","analyst_note":"Find the fixed Ettercap version and confirm the patch commit at the linked GitHub fix and vendor advisory pages.","how_to_check":"- Run `ettercap --version` (or check the installed package version) and compare it with the fixed release in the sources\n- Check whether Ettercap is installed on machines used for wireless sniffing or network auditing\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-ettercap-installed","no-wpa-key-loaded"],"who_is_affected":"Only machines that run Ettercap against a WPA-protected wireless network whose key is loaded are exposed, since the attacker must be on that network and the bug is in CCMP decryption. Systems that do not run Ettercap, or that do not use it on WPA networks, can skip it. Sources do not state a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000763,"input_tokens":4656,"output_tokens":594,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed Ettercap version and confirm the patch commit at the linked GitHub fix and vendor advisory pages.","search":"'-125404':13A,16A '-2026':12A,15A '0.8.4.1':26B,78C '8':29B,91C 'attack':47B,99C 'audit':21B 'buffer':8A,68B,119C 'byte':30B,92C 'ccmp':3A,31B,44B,84C,93C,113C 'check':37B,96C 'contain':79C 'craft':62B,112C 'cve':11A,14A 'decrypt':45B,85C 'ettercap':1A,17A,18B,24B,70B,76C,122C 'frame':4A,35B,63B,114C 'integ':41B,81C 'key':56B,105C 'length':39B,98C 'load':57B,107C 'minimum':97C 'network':20B,52B,102C 'network-audit':19B 'normal':72B,125C 'overflow':6A,65B,116C 'process':10A,123C 'root':9A,75B,128C 'run':73B,126C 'send':59B,109C 'short':2A,61B,111C 'src/ec_encryption_ccmp.c':87C 'stack':7A,67B,118C 'subtract':27B,89C 'trailer':32B,94C 'underflow':5A,42B,82C 'whose':103C 'wireless':23B,51B 'without':36B,95C 'wpa':55B,104C","nicknames":[],"mitigations":[],"who_affected":"Only machines that run Ettercap against a WPA-protected wireless network whose key is loaded are exposed, since the attacker must be on that network and the bug is in CCMP decryption. Systems that do not run Ettercap, or that do not use it on WPA networks, can skip it. Sources do not state a fixed version.","tier":"B","verified":{"fix":{"at":"2026-11-10T00:31:08Z","by":"analyst","doc":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","run_id":2358},"how_to_check":{"at":"2026-11-10T00:31:08Z","by":"analyst","doc":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","run_id":2358},"who_affected":{"at":"2026-11-10T00:31:08Z","by":"analyst","doc":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","run_id":2358}},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["ettercap"],"ptokens":["ettercap"],"labels":["ettercap","high","networkauditing","other","wireless"],"campaign_type":null,"search_a":"'-125404':13A,16A '-2026':12A,15A 'buffer':8A 'ccmp':3A 'cve':11A,14A 'ettercap':1A,17A 'frame':4A 'overflow':6A 'process':10A 'root':9A 'short':2A 'stack':7A 'underflow':5A","search_b":"'0.8.4.1':26B '8':29B 'attack':47B 'audit':21B 'buffer':68B 'byte':30B 'ccmp':31B,44B 'check':37B 'craft':62B 'decrypt':45B 'ettercap':18B,24B,70B 'frame':35B,63B 'integ':41B 'key':56B 'length':39B 'load':57B 'network':20B,52B 'network-audit':19B 'normal':72B 'overflow':65B 'root':75B 'run':73B 'send':59B 'short':61B 'stack':67B 'subtract':27B 'trailer':32B 'underflow':42B 'wireless':23B,51B 'without':36B 'wpa':55B","search_c":"'0.8.4.1':78C '8':91C 'attack':99C 'buffer':119C 'byte':92C 'ccmp':84C,93C,113C 'check':96C 'contain':79C 'craft':112C 'decrypt':85C 'ettercap':76C,122C 'frame':114C 'integ':81C 'key':105C 'length':98C 'load':107C 'minimum':97C 'network':102C 'normal':125C 'overflow':116C 'process':123C 'root':128C 'run':126C 'send':109C 'short':111C 'src/ec_encryption_ccmp.c':87C 'stack':118C 'subtract':89C 'trailer':94C 'underflow':82C 'whose':103C 'without':95C 'wpa':104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-06T02:58:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125404","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125404","severity":null,"published_at":"2026-11-10T00:17:15+00:00","modified_at":"2026-11-10T00:17:15+00:00","first_seen_at":"2026-11-10T00:28:45+00:00","fetched_at":"2026-11-10T00:28:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125404:2358","url":null,"severity":null,"published_at":"2026-11-10T00:31:08+00:00","modified_at":"2026-11-10T00:31:08+00:00","first_seen_at":"2026-11-10T00:31:08+00:00","fetched_at":"2026-11-10T00:31:08+00:00","note":"GHSA read: patched versions None; fix merged to master in commit 1d8badb (PR #1330, Nov 6 2026), no release yet. Needs monitor mode + WPA2/CCMP key and handshake. No exploitation or PoC seen."}],"documents":[{"id":111602,"url":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111615,"url":"https://github.com/Ettercap/ettercap/security/advisories/GHSA-j37f-7jx3-rf8j","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-06T02:58:23+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":111616,"url":"https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-stack-buffer-overflow-via-wpa-ccmp-decryption","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}