CVE-2024-0210: 
Wireshark vulnerability analysis and mitigation

A vulnerability was discovered in Wireshark 4.2.0's Zigbee TLV dissector that allows denial of service through packet injection or crafted capture file. The vulnerability, identified as CVE-2024-0210, was discovered by Han Zheng and publicly disclosed on January 3, 2024 (Wireshark Advisory).

The vulnerability is classified as an Uncontrolled Recursion (CWE-674) issue that leads to stack exhaustion in the Zigbee TLV dissector component. It received a CVSS v3.1 base score of 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a network-accessible vulnerability requiring no privileges or user interaction to exploit (NVD).

When successfully exploited, the vulnerability can cause Wireshark to crash, resulting in a denial of service condition. This can be triggered either by injecting malformed packets into the network or by convincing a user to open a specially crafted packet capture file (Wireshark Advisory).

The vulnerability has been fixed in Wireshark version 4.2.1. Users are advised to upgrade to this version or later to mitigate the risk (Wireshark Advisory).