CVE-2025-9649
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A vulnerability was detected in appneta tcpreplay 4.5.1 in the calc_sleep_time function of send_packets.c, leading to a divide-by-zero error. The attack requires local access, and the exploit has been publicly disclosed. Upgrading to version 4.5.3-beta3 is recommended to address the issue.
Risk Assessment
This vulnerability can cause a process crash, leading to denial of service. It requires local access, so the risk is limited to users with system access.
Recommendation
Update tcpreplay to version 4.5.3-beta3 or later. If updating is not possible, restrict local access to trusted users.
Other vulnerabilities in tcpreplay
See all- CVE-2017-14266High
Version 3.4.4 of Tcpreplay has a Heap-Based Buffer Overflow vulnerability triggered by a crafted PCAP file.
- CVE-2017-6429High
Buffer overflow in the tcpcapinfo utility in Tcpreplay before version 4.2.0 Beta 1 allows remote attackers to have unspecified impact via a pcap file with an over-size packet.
- CVE-2016-6160High
tcprewrite in tcpreplay before version 4.1.2 allows remote attackers to cause a denial of service (segmentation fault) by sending a large frame.
Original NVD description (English source)
A security vulnerability has been detected in appneta tcpreplay 4.5.1. Impacted is the function calc_sleep_time of the file send_packets.c. Such manipulation leads to divide by zero. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. Upgrading to version 4.5.3-beta3 is recommended to address this issue. It is advisable to upgrade the affected component. The vendor confirms in a GitHub issue reply: "Was able to reproduce in 6fcbf03 but NOT 4.5.3-beta3."
Vulnerability data from NVD (NIST) · CISA KEV · EPSS