CVE-2024-0210 Overview
CVE-2024-0210 is a denial-of-service vulnerability in the Zigbee Type-Length-Value (TLV) dissector of Wireshark 4.2.0. The flaw allows an attacker to crash the Wireshark process by injecting a malicious packet onto a monitored network or by tricking an analyst into opening a crafted capture file. The issue is tracked as CWE-674: Uncontrolled Recursion and was published in the Wireshark Security Advisory WNPA-SEC-2024-04. No authentication or user interaction is required when packets are processed live, and exploitation requires only network reachability to the capture interface.
Critical Impact
Successful exploitation crashes Wireshark, disrupting packet capture sessions and incident response workflows that depend on live traffic analysis.
Affected Products
- Wireshark 4.2.0
- Zigbee TLV dissector component (wireshark:wireshark)
- Installations parsing Zigbee traffic or capture files containing Zigbee TLV data
Discovery Timeline
- 2024-01-03 - CVE-2024-0210 published to the National Vulnerability Database
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2024-0210
Vulnerability Analysis
The vulnerability resides in the Zigbee TLV dissector shipped with Wireshark 4.2.0. When the dissector parses a malformed Zigbee TLV structure, control flow enters an uncontrolled recursion pattern that exhausts the process stack. The result is a hard crash of the Wireshark or tshark process. Because dissectors run automatically against every captured frame matching their protocol heuristics, a single crafted packet observed on the wire is sufficient to terminate the analyzer.
The attack is unauthenticated and remote in nature. An adversary with the ability to inject frames into a network segment Wireshark is monitoring can repeatedly crash the tool, denying defenders visibility during an active intrusion. The same condition triggers when an analyst opens a crafted .pcap or .pcapng capture file containing the malformed Zigbee TLV, expanding the attack surface to file-sharing and threat-intelligence workflows.
Root Cause
The defect is classified under CWE-674, uncontrolled recursion. The Zigbee TLV dissector does not enforce a bound on nested or chained TLV elements, allowing a crafted structure to drive the parser into deep recursive calls until the stack is exhausted. Refer to the GitLab Wireshark Issue 19504 for the upstream technical discussion.
Attack Vector
Two delivery paths are practical. The first is live packet injection on a network segment whose traffic Wireshark is capturing — common in lab, OT, and IoT environments where Zigbee gateways or 802.15.4 sniffers feed Wireshark. The second is a crafted capture file delivered to an analyst by email, chat, or shared storage. In both cases the dissector engages automatically and the process terminates.
No verified public proof-of-concept code is available. The vulnerability is described in prose only; consult the Wireshark Security Advisory WNPA-SEC-2024-04 for upstream details.
Detection Methods for CVE-2024-0210
Indicators of Compromise
- Repeated unexpected termination of wireshark or tshark processes during Zigbee or 802.15.4 capture sessions
- Crash dumps or core files referencing the Zigbee TLV dissector call stack
- Receipt of unsolicited .pcap or .pcapng files containing Zigbee TLV payloads from untrusted sources
Detection Strategies
- Inventory hosts running Wireshark 4.2.0 and flag any version that has not been upgraded to a patched release
- Inspect endpoint telemetry for abnormal exit codes or stack-overflow signals tied to Wireshark binaries
- Pre-scan shared capture files in an isolated sandbox before opening them on analyst workstations
Monitoring Recommendations
- Forward Wireshark and tshark process crash events to a centralized logging or SIEM pipeline for correlation
- Monitor Zigbee and 802.15.4 capture sessions for malformed TLV frames preceding analyzer termination
- Track software inventory changes so that downgrades to vulnerable Wireshark versions are detected promptly
How to Mitigate CVE-2024-0210
Immediate Actions Required
- Upgrade Wireshark from 4.2.0 to a fixed release as listed in WNPA-SEC-2024-04
- Restrict opening of untrusted capture files on analyst workstations until patching is complete
- Isolate Zigbee and 802.15.4 capture interfaces from untrusted network segments where feasible
Patch Information
The Wireshark Foundation released a fixed build addressing the Zigbee TLV dissector recursion. Administrators should apply the update referenced in Wireshark Security Advisory WNPA-SEC-2024-04 and confirm version strings on every endpoint that runs Wireshark or tshark. The upstream fix discussion is available at GitLab Wireshark Issue 19504.
Workarounds
- Disable the Zigbee TLV dissector through Analyze → Enabled Protocols until the patched build is deployed
- Use tshark with a protocol filter that excludes Zigbee TLV when triage cannot wait for an upgrade
- Open suspicious capture files only inside an isolated virtual machine to contain crashes
# Disable the Zigbee TLV dissector from the command line
tshark --disable-protocol zbee_tlv -r suspicious.pcapng
# Verify installed Wireshark version after patching
wireshark --version | head -n 1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
