CVE-2024-0211: 
Wireshark vulnerability analysis and mitigation

A vulnerability was identified in Wireshark version 4.2.0, specifically in its DOCSIS (Data Over Cable Service Interface Specification) dissector component. The vulnerability, tracked as CVE-2024-0211, was discovered and disclosed on January 3, 2024. The issue allows an attacker to cause a denial of service condition through either packet injection or by using a crafted capture file (Wireshark Advisory).

The vulnerability affects the DOCSIS dissector in Wireshark 4.2.0. The CVSS v3.1 base score is 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a network-accessible vulnerability requiring no privileges or user interaction to exploit. The issue is classified under CWE-835 (Loop with Unreachable Exit Condition - 'Infinite Loop') (NVD).

When exploited, this vulnerability can cause Wireshark to crash, resulting in a denial of service condition. This can occur either through malicious packet injection on a network or when a user attempts to open a specially crafted packet trace file (Wireshark Advisory).

The vulnerability can be exploited in two ways: through packet injection on a network or by convincing a user to open a malformed packet trace file. The attack vector is considered network-accessible with low attack complexity, requiring no special privileges or user interaction for exploitation (NVD).

The vulnerability has been fixed in Wireshark version 4.2.1. Users are advised to upgrade to this version or later to mitigate the risk (Wireshark Advisory).