CVE-2023-0415 in Wireshark
Summary
by MITRE • 01/26/2023
iSCSI dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/07/2026
The vulnerability identified as CVE-2023-0415 represents a critical denial of service flaw within Wireshark's iSCSI dissector functionality. This issue affects multiple versions of the popular network protocol analyzer, specifically targeting releases from 4.0.0 through 4.0.2 and 3.6.0 through 3.6.10. The vulnerability manifests when Wireshark processes iSCSI (Internet Small Computer System Interface) protocol packets, which are commonly used in storage area networks for communication between servers and storage devices. The iSCSI protocol operates at the application layer and relies on TCP for reliable data transmission, making it a critical component in enterprise storage infrastructures where network monitoring and analysis are essential for troubleshooting and security auditing.
The technical flaw stems from improper input validation and memory handling within the iSCSI dissector module of Wireshark. When processing malformed or specially crafted iSCSI packets, the dissector fails to properly validate packet structures and may attempt to access memory locations that are either invalid or uninitialized. This leads to a segmentation fault or similar memory access violation that causes Wireshark to crash and terminate unexpectedly. The vulnerability is particularly concerning because it can be triggered through two distinct attack vectors: either by injecting malicious iSCSI packets into a network capture, or by opening a pre-existing capture file that contains crafted iSCSI data. Both scenarios represent legitimate use cases for network analysts who may encounter such traffic during routine monitoring or forensic analysis activities.
The operational impact of this vulnerability extends beyond simple service disruption, as it can severely compromise network monitoring capabilities in enterprise environments. Network security teams and system administrators who rely on Wireshark for network traffic analysis, protocol debugging, and security incident response may find their monitoring tools become unavailable when processing iSCSI traffic. This vulnerability particularly affects organizations that utilize iSCSI-based storage solutions, as these environments frequently generate iSCSI traffic that would be analyzed by network monitoring tools. The crash can occur during active network capture sessions, potentially causing loss of critical network data, or when analyzing previously captured network traffic for security investigations or performance troubleshooting.
Mitigation strategies for CVE-2023-0415 primarily involve immediate version upgrades to patched releases of Wireshark, as this vulnerability has been addressed in subsequent versions. Organizations should prioritize updating their Wireshark installations to versions that contain the necessary security patches and code modifications to properly validate iSCSI packet structures. Network administrators should also implement additional monitoring to detect unusual network traffic patterns that might indicate exploitation attempts, though the vulnerability itself does not appear to enable remote code execution or data exfiltration. The vulnerability aligns with CWE-121, which describes heap-based buffer overflow conditions, and may also relate to CWE-125, indicating out-of-bounds read errors. From an ATT&CK framework perspective, this vulnerability could be categorized under T1499.004 for network denial of service, and potentially T1566.001 for initial access through malicious network traffic, though the attack surface is limited to the specific network analysis tool rather than broader system compromise.