LiveActive security incident?Get immediate response
CVE Record

CVE-2017-9351: In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DHCP dissector could read past the end of a buffer.

In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DHCP dissector could read past the end of a buffer. This was addressed in epan/dissectors/packet-bootp.c by extracting the Vendor Class Identifier more carefully.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2017-9351 affects older Wireshark releases. A malformed DHCP packet or capture could cause the DHCP parser to read beyond its buffer. The public bundle does not provide CVSS, CWE, confirmed impact detail, or active exploitation evidence, so urgency depends on whether affected Wireshark versions remain in use.

Executive priority

Treat as a targeted hygiene issue, not an emergency, unless affected Wireshark versions are used on systems that process untrusted captures at scale.

Technical view

Wireshark 2.2.0 through 2.2.6 and 2.0.0 through 2.0.12 are listed as affected. The DHCP dissector in packet-bootp.c could read past the end of a buffer while handling Vendor Class Identifier data. The referenced fix extracts that field more carefully.

Likely exposure

Exposure is mainly analyst workstations, packet-analysis systems, malware labs, and automated pipelines that open untrusted packet captures or inspect DHCP traffic with affected Wireshark versions.

Exploitation context

The bundle does not cite CISA KEV listing or confirmed exploitation. Public references include OSS-Fuzz and Wireshark bug/advisory entries, suggesting discovery through testing, but exploitability and real-world use are not established here.

Researcher notes

Evidence supports an out-of-bounds read in the DHCP dissector and a code-level fix in packet-bootp.c. The source bundle lacks CVSS, CWE, crash impact detail, and exploitation confirmation, so avoid overstating severity.

Mitigation direction

  • Identify Wireshark versions in analyst and capture-processing environments.
  • Upgrade affected Wireshark releases using official Wireshark guidance.
  • Avoid opening untrusted packet captures on affected versions.
  • Isolate legacy packet-analysis systems if immediate upgrade is not possible.
  • Monitor vendor advisories for any additional remediation guidance.

Validation and detection

  • Check installed Wireshark versions against 2.2.0-2.2.6 and 2.0.0-2.0.12.
  • Confirm upgraded systems are outside the affected version ranges.
  • Review packet-processing services for embedded Wireshark or tshark usage.
  • Verify analysts do not process untrusted captures on legacy installations.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2017-9351 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
7Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.