{"id":"CVE-2026-125406","kind":"vulnerability","aliases":["CVE-2026-125406"],"related":[],"title":"Ettercap: telnet dissector backspace handling corrupts stack, may run code as root","description":"Ettercap through 0.8.4.1 contains a stack buffer underwrite vulnerability in the telnet dissector in src/dissectors/ec_telnet.c that decrements the output pointer on backspace without a lower bound check. Attackers can send a telnet stream with more backspaces than preceding characters to write below the stack buffer, corrupting the stack of the Ettercap process that normally runs as root.","summary":"Ettercap's telnet dissector decrements its output pointer on backspace without a lower bound check, so a crafted telnet stream with more backspaces than preceding characters writes below a stack buffer. An attacker can corrupt the stack of the Ettercap process, which normally runs as root.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ettercap","linux","network-sniffing","other"],"not_affected_if":["ettercap-not-installed"],"how_to_check":"- Ettercap is in the affected range if its version is `0.8.4.1` or earlier (through `0.8.4.1`)\n- Look at the Ettercap install on hosts that sniff network traffic; the flaw is in src/dissectors/ec_telnet.c","fix":"- Ettercap versions after `0.8.4.1` are not stated as fixed in the sources; check the linked patch and vendor advisory for the fixed version","status":"open","published_at":"2026-11-10T00:17:15+00:00","first_seen_at":"2026-11-10T00:28:45+00:00","triaged_at":"2026-11-10T00:29:46+00:00","updated_at":"2026-11-10T00:29:46+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T00:29:46Z","model":"claude-haiku-5-5","output":{"fix":"- Ettercap versions after `0.8.4.1` are not stated as fixed in the sources; check the linked patch and vendor advisory for the fixed version","reach":"network","title":"Ettercap: telnet dissector backspace handling corrupts stack, may run code as root","impact":"high","summary":"Ettercap's telnet dissector decrements its output pointer on backspace without a lower bound check, so a crafted telnet stream with more backspaces than preceding characters writes below a stack buffer. An attacker can corrupt the stack of the Ettercap process, which normally runs as root.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ettercap","network-sniffing","linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker corrupts stack of root-running Ettercap process, possibly running code","analyst_note":"","how_to_check":"- Ettercap is in the affected range if its version is `0.8.4.1` or earlier (through `0.8.4.1`)\n- Look at the Ettercap install on hosts that sniff network traffic; the flaw is in src/dissectors/ec_telnet.c","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["ettercap-not-installed"],"who_is_affected":"Teams that run Ettercap to sniff or intercept network traffic are exposed, because the telnet dissector parses traffic Ettercap sees on the wire. Systems that do not have Ettercap installed, or do not parse telnet traffic with it, can skip it. Whether a default configuration enables the telnet dissector is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00114,"input_tokens":4643,"output_tokens":1352,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125406':15A,18A '-2026':14A,17A '0.8.4.1':72C 'attack':56B,97C 'backspac':4A,33B,46B,91C,105C 'bound':37B,95C 'buffer':54B,76C,114C 'charact':49B,108C 'check':38B,96C 'code':10A 'contain':73C 'corrupt':6A,58B,115C 'craft':41B 'cve':13A,16A 'decrement':28B,86C 'dissector':3A,27B,82C 'ettercap':1A,19B,24B,63B,70C,120C 'handl':5A 'linux':20B 'lower':36B,94C 'may':8A 'network':22B 'network-snif':21B 'normal':66B,123C 'output':30B,88C 'pointer':31B,89C 'preced':48B,107C 'process':64B,121C 'root':12A,69B,126C 'run':9A,67B,124C 'send':99C 'snif':23B 'src/dissectors/ec_telnet.c':84C 'stack':7A,53B,60B,75C,113C,117C 'stream':43B,102C 'telnet':2A,26B,42B,81C,101C 'underwrit':77C 'vulner':78C 'without':34B,92C 'write':50B,110C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Ettercap to sniff or intercept network traffic are exposed, because the telnet dissector parses traffic Ettercap sees on the wire. Systems that do not have Ettercap installed, or do not parse telnet traffic with it, can skip it. Whether a default configuration enables the telnet dissector is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ettercap","high","linux","networksniffing","other"],"campaign_type":null,"search_a":"'-125406':15A,18A '-2026':14A,17A 'backspac':4A 'code':10A 'corrupt':6A 'cve':13A,16A 'dissector':3A 'ettercap':1A 'handl':5A 'may':8A 'root':12A 'run':9A 'stack':7A 'telnet':2A","search_b":"'attack':56B 'backspac':33B,46B 'bound':37B 'buffer':54B 'charact':49B 'check':38B 'corrupt':58B 'craft':41B 'decrement':28B 'dissector':27B 'ettercap':19B,24B,63B 'linux':20B 'lower':36B 'network':22B 'network-snif':21B 'normal':66B 'output':30B 'pointer':31B 'preced':48B 'process':64B 'root':69B 'run':67B 'snif':23B 'stack':53B,60B 'stream':43B 'telnet':26B,42B 'without':34B 'write':50B","search_c":"'0.8.4.1':72C 'attack':97C 'backspac':91C,105C 'bound':95C 'buffer':76C,114C 'charact':108C 'check':96C 'contain':73C 'corrupt':115C 'decrement':86C 'dissector':82C 'ettercap':70C,120C 'lower':94C 'normal':123C 'output':88C 'pointer':89C 'preced':107C 'process':121C 'root':126C 'run':124C 'send':99C 'src/dissectors/ec_telnet.c':84C 'stack':75C,113C,117C 'stream':102C 'telnet':81C,101C 'underwrit':77C 'vulner':78C 'without':92C 'write':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-06T02:58:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125406","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125406","severity":null,"published_at":"2026-11-10T00:17:15+00:00","modified_at":"2026-11-10T00:17:15+00:00","first_seen_at":"2026-11-10T00:28:45+00:00","fetched_at":"2026-11-10T00:28:45+00:00","note":null}],"documents":[{"id":111602,"url":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111621,"url":"https://github.com/Ettercap/ettercap/security/advisories/GHSA-w5ch-7c4x-crcc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-06T02:58:25+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":111622,"url":"https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-stack-buffer-underwrite-via-telnet-dissector-backspace-handling","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}