CVE-2026-125404— Ettercap through 0.8.4.1 Stack Buffer Overflow via WPA CCMP Decryption

Quick assessment

Affected

Ettercap ettercap

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Ettercap 0.8.4.1 及更早版本在中的函数存在整数下溢漏洞。该函数在减去 8 字节的 CCMP 尾部时，未对最小长度进行检查。若攻击者处于已加载 WPA 密钥的网络中，可发送一个精心构造的短 CCMP 帧，导致 Ettercap 进程中的栈缓冲区溢出。由于 Ettercap 通常以 root 权限运行，该漏洞可能被利用以获取系统控制权。

CVSS 7.5 · High Updated Nov 10, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Ettercap through 0.8.4.1 Stack Buffer Overflow via WPA CCMP Decryption

Source: CVE Program / CVE List V5

Vulnerability Description

Ettercap through 0.8.4.1 contains an integer underflow in ccmp_decrypt() in src/ec_encryption_ccmp.c that subtracts the 8-byte CCMP trailer without checking minimum length. Attackers on a network whose WPA key is loaded can send a short crafted CCMP frame to overflow a stack buffer in the Ettercap process, which normally runs as root.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

整数下溢(超界折返)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Ettercap	ettercap	0 ~ 0.8.4.1	-

II. Public POCs for CVE-2026-125404

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-125404

请登录查看更多情报信息。

Other References for CVE-2026-125404 (5)

https://github.com/Ettercap/ettercap/blob/v0.8.4.1/src/ec_encryption_ccmp.c#L190-L203 technical-description
https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98 patch
https://github.com/Ettercap/ettercap/pull/1330 issue-tracking patch
https://github.com/Ettercap/ettercap/security/advisories/GHSA-j37f-7jx3-rf8j vendor-advisory
https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-stack-buffer-overflow-via-wpa-ccmp-decryption third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-125404

Same Patch Batch · Ettercap · 2026-11-09 · 7 CVEs total

CVE-2026-125406	8.8 HIGH	Ettercap through 0.8.4.1 Stack Buffer Underwrite via Telnet Dissector Backspace Handling
CVE-2026-125400	8.8 HIGH	Ettercap through 0.8.4.1 Use-After-Free via PCRE2 Filter Substitution
CVE-2026-125401	8.1 HIGH	Ettercap through 0.8.4.1 Heap Buffer Overflow via Gadu-Gadu Dissector
CVE-2026-125403	8.1 HIGH	Ettercap through 0.8.4.1 Out-of-Bounds Read via sslw_remove_sts
CVE-2026-125405	8.1 HIGH	Ettercap through 0.8.4.1 Out-of-Bounds Read via HTTP NTLM Authentication Parsing
CVE-2026-125402	8.1 HIGH	Ettercap through 0.8.4.1 Heap Out-of-Bounds Read via TLS SNI Parsing

IV. Related Vulnerabilities

Same product: ettercap

Same vendor: Ettercap

Same weakness: CWE-191