CVE-2025-9649CWE-369CWE-404

CVE-2025-9649

Low · published August 29, 2025

CVSS v3.1
3.3
EPSS
0%
Percentile
15.4
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in appneta tcpreplay 4.5.1. Impacted is the function calc_sleep_time of the file send_packets.c. Such manipulation leads to divide by zero. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. Upgrading to version 4.5.3-beta3 is recommended to address this issue. It is advisable to upgrade the affected component. The vendor confirms in a GitHub issue reply: "Was able to reproduce in 6fcbf03 but NOT 4.5.3-beta3."

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00250 · 15.4th percentile
Weaknesses
CWE-369 · Divide By Zero; CWE-404 · Improper Resource Shutdown or Release
Published
2025-08-29T18:15Z
Affected products (1)
ProductVersionsFixed in
broadcom/tcpreplayall versions—
References (7)
https://drive.google.com/file/d/16QQtZvUrMbF-i_1cGt5hNWmkn-YVyBOM/view?usp=sharing · [email protected]https://github.com/appneta/tcpreplay/issues/968 · [email protected]https://github.com/appneta/tcpreplay/issues/968#issuecomment-3226338070 · [email protected]https://vuldb.com/?ctiid.321855 · [email protected]https://vuldb.com/?id.321855 · [email protected]https://vuldb.com/?submit.630493 · [email protected]https://vuldb.com/?submit.630494 · [email protected]
EPSS history
Timeline
  • 29 AUG 13:32Z
    appneta tcpreplay send_packets.c calc_sleep_time divide by zero
    cvelistv5