Vulnerability record · CVE-2013-4074 · published 9 June 2013
CVE-2013-4074: Wireshark CAPWAP dissector error handling crash
Wireshark · Wireshark
The CAPWAP dissector in Wireshark 1.6.x before 1.6.16 and 1.8.x before 1.8.8 misuses a -1 data value to signal an error condition, so a crafted packet can crash the application. This is a denial-of-service flaw in a widely deployed network analysis tool, and the record does not state any confidentiality or integrity impact.
Description
The dissect_capwap_data function in epan/dissectors/packet-capwap.c in the CAPWAP dissector in Wireshark 1.6.x before 1.6.16 and 1.8.x before 1.8.8 incorrectly uses a -1 data value to represent an error condition, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
AV:N/AC:L/Au:N/C:N/I:N/A:P
Automated analysis
medium priorityRemote unauthenticated crash with public exploit code and high EPSS, but impact is limited to denial of service and the flaw is long patched.
What it is
The CAPWAP dissector in Wireshark 1.6.x before 1.6.16 and 1.8.x before 1.8.8 misuses a -1 data value to signal an error condition, so a crafted packet can crash the application. This is a denial-of-service flaw in a widely deployed network analysis tool, and the record does not state any confidentiality or integrity impact.
Impact
An attacker can crash the Wireshark process, disrupting packet capture and analysis sessions. The CVSS vector shows availability impact only, with no confidentiality or integrity loss.
Attack surface
Reached remotely over the network by delivering a crafted CAPWAP packet that Wireshark dissects; the vector AV:N/AC:L/Au:N indicates no authentication and no user interaction beyond the victim capturing or opening the traffic.
Exploitation
Public exploit code exists per the Exploit tags on Packet Storm and Exploit-DB references, and EPSS is 0.60643 (99th percentile), but the CVE is not listed in CISA KEV.
What to do
- Upgrade Wireshark to 1.6.16 or 1.8.8 or later, or apply the vendor patch for the CAPWAP dissector.
- Apply the Debian, openSUSE, Gentoo or Mandriva security updates for the affected packages.
- Avoid capturing or opening untrusted CAPWAP traffic on production analysis hosts until patched.
- Run Wireshark with least privilege and isolate capture hosts from sensitive networks.
Detection
- Monitor for repeated Wireshark process crashes or abnormal terminations on analyst workstations.
- Inspect CAPWAP traffic for malformed or truncated packets that trigger dissector errors.
- Track endpoint versions of Wireshark and flag hosts still running 1.6.x before 1.6.16 or 1.8.x before 1.8.8.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2013-4074 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2013-4074), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
