{"id":"CVE-2026-125406","published":"2026-11-10T00:17:15.507","lastModified":"2026-11-10T00:17:15.507","description":"Ettercap through 0.8.4.1 contains a stack buffer underwrite vulnerability in the telnet dissector in src/dissectors/ec_telnet.c that decrements the output pointer on backspace without a lower bound check. Attackers can send a telnet stream with more backspaces than preceding characters to write below the stack buffer, corrupting the stack of the Ettercap process that normally runs as root.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-124"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Ettercap/ettercap/blob/v0.8.4.1/src/dissectors/ec_telnet.c#L150-L159","tags":[]},{"url":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","tags":[]},{"url":"https://github.com/Ettercap/ettercap/pull/1330","tags":[]},{"url":"https://github.com/Ettercap/ettercap/security/advisories/GHSA-w5ch-7c4x-crcc","tags":[]},{"url":"https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-stack-buffer-underwrite-via-telnet-dissector-backspace-handling","tags":[]}],"exploitRefs":[{"url":"https://github.com/Ettercap/ettercap/blob/v0.8.4.1/src/dissectors/ec_telnet.c#L150-L159","tags":[]},{"url":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","tags":[]},{"url":"https://github.com/Ettercap/ettercap/pull/1330","tags":[]},{"url":"https://github.com/Ettercap/ettercap/security/advisories/GHSA-w5ch-7c4x-crcc","tags":[]}],"hasPoc":true,"ai":{"summary":"Ettercap through 0.8.4.1 has a stack buffer underwrite in its telnet dissector due to missing bounds checking when processing backspace characters, allowing an attacker to corrupt stack memory by sending a telnet stream with excessive backspaces relative to preceding data. This occurs because the output pointer is decremented without verifying it remains within the buffer bounds.","exploitability":"Exploitation requires network access to a target running Ettercap's telnet dissector (typically in a MITM role), with no authentication or user interaction needed, making it highly exploitable in compromised network segments.","blast_radius":"Successful exploitation could lead to remote code execution as root since Ettercap typically runs with elevated privileges, enabling full system compromise and lateral movement within the target network.","remediation":"Upgrade to Ettercap version 0.8.5 or later, which includes a fix for the stack buffer underwrite in the telnet dissector.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["buffer-overflow","stack-corruption","mitm","telnet","root-privilege"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:48:42.248Z"}}