CVE-2024-4854

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

No affected versions have been published.

Timeline

Published: May 14, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-485406.2Incorrect access control in XIAO HE Smart 4.3.1 allows attackers to access sensitive information by analyzing the code and data within the A CVE-2024-485418.4Incorrect access control in the firmware update and download processes of Ruochan Smart v4.4.7 allows attackers to access sensitive informat CVE-2024-485428.4Incorrect access control in the firmware update and download processes of Yamaha Headphones Controller v1.6.7 allows attackers to access sen CVE-2024-485448.4Incorrect access control in the firmware update and download processes of Sylvania Smart Home v3.0.3 allows attackers to access sensitive in CVE-2024-485458.4Incorrect access control in the firmware update and download processes of IVY Smart v4.5.0 allows attackers to access sensitive information CVE-2024-485468.4Incorrect access control in the firmware update and download processes of Wear Sync v1.2.0 allows attackers to access sensitive information CVE-2024-485478.4Incorrect access control in the firmware update and download processes of DreamCatcher Life v1.8.7 allows attackers to access sensitive info CVE-2024-485489.3The APK file in Cloud Smart Lock v2.0.1 has a leaked a URL that can call an API for binding physical devices. This vulnerability allows atta CVE-2024-48555.5Use after free issue in editcap could cause denial of service via crafted capture file CVE-2024-48568.2The FS Product Inquiry WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outputting it back in the page, leadin CVE-2024-485695.4Proactive Risk Manager version 9.1.1.0 is affected by multiple Cross-Site Scripting (XSS) vulnerabilities in the add/edit form fields, at th CVE-2024-48576.1The FS Product Inquiry WordPress plugin through 1.1.1 does not sanitise and escape some form submissions, which could allow unauthenticated