Wireshark LoRaWAN decryption flaw can yield remote code execution
Original title: ZDI-26-898: Wireshark LoRaWAN Decryption Numeric Truncation Error Remote Code Execution Vulnerability
Only Wireshark instances with LoRaWAN decryption enabled are vulnerable; ZDI rates it CVSS 7.1.
ZDI published ZDI-26-898, a numeric truncation error in Wireshark's LoRaWAN decryption that can let network-adjacent attackers execute arbitrary code. Authentication is not required, but the flaw applies only when LoRaWAN decryption is enabled. ZDI assigned a CVSS score of 7.1. No CVE, patch, or exploitation status is stated.
- Tracked as ZDI-26-898; no CVE is named.
- Attackers need only network-adjacent access and no authentication.
- Instances without LoRaWAN decryption enabled are not vulnerable.
- ZDI assigned a CVSS rating of 7.1.
Impact: Network-adjacent arbitrary code execution without authentication
| Product | Affected |
|---|---|
| Wireshark | — |
- 1.Disable LoRaWAN decryption in Wireshark if it is not required.
From the original article
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Wireshark. Authentication is not required to exploit this vulnerability. However, only instances with LoRaWAN decryption enabled are vulnerable.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.