CVE-2025-9019

LOW EPSS 55.7%
Published Aug 15, 202510mo ago · Modified Jun 17, 20262w ago
1.3 CVSS 4.0
Low
Find Similar
Published Aug 15, 2025 10mo ago
Last Modified Jun 17, 2026 2w ago

Description

A vulnerability has been found in tcpreplay 4.5.1. This vulnerability affects the function mask_cidr6 of the file cidr.c of the component tcpprep. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The researcher is able to reproduce this with the latest official release 4.5.1 and the current master branch. The code maintainer cannot reproduce this for 4.5.2-beta1. In his reply the maintainer explains that "[i]n that case, this is a duplicate that was fixed in 4.5.2."

CVSS Details

Base Score
1.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction P
Scope X

Threat Intelligence

EPSS Exploit Probability
55.7% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 3

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Memory Safety
CWE-122
CWE-787 Out-of-bounds Write Memory Safety

Affected Products 1

VendorProductVersionRange
broadcomtcpreplay4.5.1any

References 11

  • drive.google.com https://drive.google.com/file/d/13SQYVIb_YQoRfaJaaLf6iLtMiCRCHlBc/view?usp=sharing
    Exploit
  • github.com https://github.com/appneta/tcpreplay/issues/958
    ExploitIssue TrackingPatchVendor Advisory
  • github.com https://github.com/appneta/tcpreplay/issues/958#issuecomment-3124876035
    ExploitIssue TrackingPatchVendor Advisory
  • github.com https://github.com/appneta/tcpreplay/issues/959
    ExploitIssue TrackingVendor Advisory
  • vuldb.com https://vuldb.com/?ctiid.320080
    Permissions RequiredVDB Entry
  • vuldb.com https://vuldb.com/?id.320080
    Third Party AdvisoryVDB Entry
  • vuldb.com https://vuldb.com/?submit.623635
    ExploitThird Party AdvisoryVDB Entry
  • vuldb.com https://vuldb.com/?submit.623636
    ExploitThird Party AdvisoryVDB Entry
  • vuldb.com https://vuldb.com/?submit.623637
    ExploitThird Party AdvisoryVDB Entry
  • vuldb.com https://vuldb.com/?submit.623638
    ExploitThird Party AdvisoryVDB Entry
  • vuldb.com https://vuldb.com/?submit.623639
    ExploitThird Party AdvisoryVDB Entry

Remediation

  • github.com https://github.com/appneta/tcpreplay/issues/958
    ExploitIssue TrackingPatchVendor Advisory
  • github.com https://github.com/appneta/tcpreplay/issues/958#issuecomment-3124876035
    ExploitIssue TrackingPatchVendor Advisory