Wireshark ciscodump CVE-2026-15164

Exploitation requires that ciscodump (the Wireshark remote Cisco capture extcap) be actively used to capture from a source the attacker can influence - i.e., the analyst must initiate a ciscodump capture against a malicious or compromised Cisco device (or a network path where crafted data can be injected). Limiting factors: this is not a passively exposed network service, so despite the CVSS AV:N/UI:N rating the attack in practice depends on operator action to run the tool; only the affected versions (4.6.0-4.6.6, 4.4.0-4.4.16) are vulnerable; and the outcome is confined to crashing the ciscodump process (availability only), not the host or Wireshark GUI.

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) rates this as network-reachable, unauthenticated, no-interaction with high availability impact - but this framing is in tension with ciscodump's real-world usage: it is an analyst-driven tool that an operator must actively launch and point at a remote Cisco source, so no-interaction network exploitation of a passive listener is unlikely. The impact is confined to availability (C:N/I:N/A:H) and CISA's SSVC rates Technical Impact only as 'partial' and Automatable as 'no', consistent with a single-process crash rather than a wormable or code-execution event. EPSS is 0.10% (1st percentile) and the CVE is not in KEV, so despite the 7.5 'High' score this is a low-real-priority DoS: it disrupts a diagnostic tool, not a production service. Verify the attack vector with the vendor advisory - the CVSS AV:N/UI:N appears optimistic given the tool must be operator-initiated.

An analyst uses ciscodump to remotely capture traffic from a Cisco device that is attacker-controlled or has been compromised; the device returns malformed capture data that triggers the heap-based buffer overflow and crashes ciscodump, aborting the capture session. A POC is referenced in the SSVC data, though no weaponized public exploit was identified. The impact is limited to denial of service of the capture tool with no code execution or data disclosure claimed.