CVE-2025-9649

EUVD-2025-26193
A security vulnerability has been detected in appneta tcpreplay 4.5.1. Impacted is the function calc_sleep_time of the file send_packets.c. Such manipulation leads to divide by zero. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. Upgrading to version 4.5.3-beta3 is recommended to address this issue. It is advisable to upgrade the affected component. The vendor confirms in a GitHub issue reply: "Was able to reproduce in 6fcbf03 but NOT 4.5.3-beta3."
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulDBCNA
3.3 LOW
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 15.5%
Affected Products (NVD)
VendorProductVersion
broadcomtcpreplay
4.5.1
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
appnetatcpreplay
4.5.1
CNA
Debian logo
Debian Releases
Debian Product
Codename
tcpreplay
bookworm
unimportant
bullseye
unimportant
forky
4.5.4-1
fixed
sid
4.5.4-1
fixed
trixie
unimportant
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
tcpreplay
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
plucky
ignored
questing
ignored
resolute
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://drive.google.com/file/d/16QQtZvUrMbF-i_1cGt5hNWmkn-YVyBOM/view?usp=sharing
https://github.com/appneta/tcpreplay/issues/968
https://github.com/appneta/tcpreplay/issues/968#issuecomment-3226338070
https://vuldb.com/?ctiid.321855
https://vuldb.com/?id.321855
https://vuldb.com/?submit.630493
https://vuldb.com/?submit.630494