CVE-2024-0210: 
Wireshark vulnerability analysis and mitigation

A vulnerability was discovered in Wireshark 4.2.0's Zigbee TLV dissector that allows denial of service through packet injection or crafted capture file. The vulnerability, identified as CVE-2024-0210, was discovered by Han Zheng and publicly disclosed on January 3, 2024 (Wireshark Advisory).

The vulnerability is classified as an Uncontrolled Recursion (CWE-674) issue that leads to stack exhaustion in the Zigbee TLV dissector component. It received a CVSS v3.1 base score of 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a network-accessible vulnerability requiring no privileges or user interaction to exploit (NVD).

When successfully exploited, the vulnerability can cause Wireshark to crash, resulting in a denial of service condition. This can be triggered either by injecting malformed packets into the network or by convincing a user to open a specially crafted packet capture file (Wireshark Advisory).

The vulnerability can be exploited through two methods: by injecting malformed packets onto the network or by creating a malicious packet capture file that targets the Zigbee TLV dissector. The issue was confirmed through fuzzing tests that demonstrated stack exhaustion in the dissect_zbee_tlvs function (GitLab Issue).

The vulnerability has been fixed in Wireshark version 4.2.1. Users are advised to upgrade to this version or later to mitigate the risk (Wireshark Advisory).