Security readout for executives and security teams
Plain-English summary
CVE-2022-3190 can make affected Wireshark versions hang while analyzing certain packet data. The business impact is mainly disruption to analysts or automated packet-analysis workflows, not server takeover. Systems using Wireshark 3.6.0-3.6.7 or 3.4.0-3.4.15 should be updated.
Executive priority
Treat this as a moderate operational risk. Prioritize patching in SOC, incident response, and network engineering environments where analysts routinely inspect untrusted traffic or capture files. It is less urgent than internet-facing remote code execution, but it can disrupt security operations.
Technical view
The flaw is an infinite loop in Wireshark's F5 Ethernet Trailer protocol dissector. Sources describe denial of service via packet injection or a crafted capture file. The affected ranges are Wireshark 3.6.0 through 3.6.7 and 3.4.0 through 3.4.15, with CVSS 3.1 score 6.3.
Likely exposure
Exposure is most likely on analyst workstations, lab systems, and packet-analysis environments that open untrusted capture files or monitor traffic containing F5 Ethernet Trailer data. The source bundle names Wireshark only; it does not identify other affected products.
Exploitation context
CISA KEV status is false in the provided bundle, and no cited source here reports active exploitation. The described abuse path requires Wireshark to process malicious packet data or a crafted capture file, causing denial of service rather than confirmed code execution.
Researcher notes
The strongest evidence is the Wireshark advisory and CVE record. The bundle does not provide CWE classification or active exploitation evidence. Validation should focus on vulnerable version presence and whether F5 Ethernet Trailer dissection occurs in workflows handling untrusted packet data.
Mitigation direction
- Upgrade Wireshark beyond 3.6.7 or 3.4.15 using vendor-supported packages.
- Check Wireshark, Fedora, and Debian advisories for package-specific fixed versions.
- Limit opening untrusted capture files on vulnerable analyst workstations.
- Use isolated analysis environments for suspicious packet captures until updated.
Validation and detection
- Inventory Wireshark versions across analyst, lab, and monitoring systems.
- Confirm no installed version is 3.6.0-3.6.7 or 3.4.0-3.4.15.
- Review package manager advisory status for Fedora or Debian-managed hosts.
- Check workflows that automatically ingest external packet captures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-3190 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L2.83.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wireshark.org/security/wnpa-sec-2022-06.htmlCVE reference
- https://gitlab.com/wireshark/wireshark/-/issues/18307CVE reference
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3190.jsonCVE reference
- FEDORA-2022-1f2fbb087eCVE reference · vendor-advisory
- FEDORA-2022-9d4aa8a486CVE reference · vendor-advisory
- https://lists.debian.org/debian-lts-announce/2024/09/msg00049.htmlCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.