CVE-2024-0210
📋 TL;DR
This vulnerability in Wireshark's Zigbee TLV dissector allows attackers to cause a denial of service (crash) by injecting specially crafted packets or providing a malicious capture file. It affects users running Wireshark 4.2.0 who analyze Zigbee network traffic or open untrusted capture files.
💻 Affected Systems
- Wireshark
📦 What is this software?
Wireshark by Wireshark
⚠️ Risk & Real-World Impact
Worst Case
Complete Wireshark application crash, potentially causing data loss of unsaved captures and disrupting network analysis operations.
Likely Case
Application crash when processing malicious Zigbee packets or capture files, requiring restart and potentially losing unsaved work.
If Mitigated
No impact if patched or if vulnerable dissector is disabled; limited to Wireshark application only, not affecting underlying system.
🎯 Exploit Status
Exploitation requires network access to inject packets or ability to provide malicious capture file; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.2.1 and later
Vendor Advisory: https://www.wireshark.org/security/wnpa-sec-2024-04.html
Restart Required: Yes
Instructions:
1. Download Wireshark 4.2.1 or later from wireshark.org. 2. Install the update, replacing the vulnerable version. 3. Restart Wireshark to ensure the fix is active.
🔧 Temporary Workarounds
Disable Zigbee TLV dissector
allPrevents the vulnerable dissector from processing packets, eliminating the crash vector.
In Wireshark: Analyze -> Enabled Protocols -> Uncheck 'Zigbee TLV'
🧯 If You Can't Patch
- Avoid analyzing untrusted capture files or Zigbee network traffic
- Restrict network access to prevent packet injection attacks
🔍 How to Verify
Check if Vulnerable:
Check Wireshark version via Help -> About Wireshark; if version is exactly 4.2.0, you are vulnerable.Check Version:
wireshark --version | grep 'Wireshark'Verify Fix Applied:
Verify version is 4.2.1 or later via Help -> About Wireshark.📡 Detection & Monitoring
Log Indicators:
- Wireshark crash logs, abnormal termination events
Network Indicators:
- Unusual Zigbee protocol traffic patterns, malformed TLV packets
SIEM Query:
EventID: 1000 Application Error for wireshark.exe OR Process: wireshark Termination