CVE-2025-9384
EUVD-2025-2884224.08.2025, 10:15
A vulnerability was detected in appneta tcpreplay up to 4.5.1. Impacted is the function tcpedit_post_args of the file /src/tcpedit/parse_args.c. The manipulation results in null pointer dereference. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version 4.5.2-beta2 is recommended to address this issue. Upgrading the affected component is advised. The vendor explains, that he was "[a]ble to reproduce in 6fcbf03 but not in 4.5.2-beta2".Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| broadcom | tcpreplay | 𝑥 ≤ 4.5.1 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| appneta | tcpreplay | 4.5.0 | CNA |
| appneta | tcpreplay | 4.5.1 | CNA |
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-404 - Improper Resource Shutdown or ReleaseThe program does not release or incorrectly releases a resource before it is made available for re-use.
- CWE-476 - NULL Pointer DereferenceA NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.
References