Cpe:2.3:a:ettercap:ettercap:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aettercapettercap/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 02:05:51 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgEttercap: Stack buffer underwrite in telnet dissector (CVE-2026-125406)https://feed.craftedsignal.io/briefs/2026-11-ettercap-stack-buffer-underwrite/Tue, 10 Nov 2026 02:05:51 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-ettercap-stack-buffer-underwrite/Ettercap versions through 0.8.4.1 are vulnerable to a stack buffer underwrite in the telnet dissector, which could allow an unauthenticated attacker to corrupt memory and potentially execute arbitrary code with root privileges.Ettercap versions through 0.8.4.1 contain a stack buffer underwrite vulnerability in the telnet dissector located in 'src/dissectors/ec_telnet.c'. The vulnerability exists because the software fails to perform a lower bound check when decrementing the output pointer in response to a backspace character. An attacker providing a malicious telnet stream containing more backspaces than preceding characters can write data below the intended stack buffer.

Impact

Successful exploitation allows for memory corruption within the Ettercap process. As Ettercap is frequently executed with root privileges, this vulnerability poses a high risk of arbitrary code execution or denial of service through process crashes.

Recommendation

  • Audit infrastructure to identify and inventory all instances of Ettercap 0.8.4.1 or earlier.
  • Prioritize the isolation of systems running Ettercap in untrusted network environments until a patched version is available.
  • Implement network-level inspection to identify anomalous telnet traffic patterns (excessive backspace characters) directed at systems running Ettercap.
]]>highadvisoryvulnerabilityremote-code-executionnetwork-security