Technical impact
Ettercap version 0.8.5.1 includes a heap out‑of‑bounds read in the SOCKS5 dissector, triggered by unchecked username/password length fields. A network‑adjacent attacker can send a specially crafted SOCKS5 authentication packet that Ettercap processes while capturing traffic. The vulnerable code reads up to 255 bytes beyond the intended heap buffer, allowing the attacker to disclose memory contents that Ettercap may print or log as credential data, effectively leaking usernames and passwords used on the network.
Affected Systems
This flaw affects all Ettercap implementations built with versions up to and including 0.8.5.1. The product is the Ettercap packet manipulation and sniffing tool used for man‑in‑the‑middle and intrusion detection tasks. Any deployment of this software, regardless of operating system, should verify its installed version and plan to upgrade.
Risk and Exploitability
The CVSS score of 7.1 indicates a high severity with significant impact on confidentiality. Although an EPSS score is not reported, the attack demands a network‑adjacent attacker who can inject a crafted packet into the traffic that Ettercap observes. The vulnerability can be exploited without elevated privileges, meaning any host running Ettercap is potentially exposed. The flaw is not listed in the CISA KEV catalog, but the realistic scenario makes the risk non‑negligible.
