CVE-2017-13689: The IKEv1 parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c:ikev1_id_print().

Security readout for executives and security teams

This flaw is in tcpdump’s IKEv1 packet parser before version 4.9.2. A specially formed packet or capture containing IKEv1 data could make tcpdump read past a buffer while decoding it. The main business concern is monitoring or troubleshooting systems processing untrusted network traffic or packet captures. Exposure is likely on Linux, Unix, macOS, or appliance environments that include tcpdump before 4.9.2 and use it to inspect IKEv1/IPsec traffic or untrusted packet captures. The source bundle does not identify specific product CPEs beyond tcpdump itself. Prioritize remediation on packet capture, network monitoring, incident response, and administrator workstations. The CVSS score is critical, but business urgency depends on whether vulnerable tcpdump versions process untrusted traffic or captures. No source provided evidence of active exploitation. Mitigation focus: Upgrade tcpdump to 4.9.2 or a vendor-fixed package.; Apply relevant OS vendor advisories for Debian, Gentoo, Apple, or Red Hat environments.; Limit tcpdump use on untrusted captures until patched..

Prepared

May 22, 2026, 17:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.