« Volver al listado

CVE-2025-68381

Estado: AnalizadaMedia (6.5)—

Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow (CAPEC-100) and reliably crash the application or cause significant resource exhaustion via a single crafted UDP packet with an invalid fragment sequence number.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Elasticsearch — Packetbeat

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-68381",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-68381",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-12-18T22:02:58.564156Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@elastic.co",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@elastic.co",
      "affectedData": [
        {
          "vendor": "Elastic",
          "product": "Packetbeat",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "7.17.29"
            },
            {
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "8.19.8"
            },
            {
              "status": "affected",
              "version": "9.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "9.1.8"
            },
            {
              "status": "affected",
              "version": "9.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "9.2.2"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-12-18T22:16:02.070",
  "references": [
    {
      "url": "https://discuss.elastic.co/t/packetbeat-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-30/384178",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@elastic.co"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@elastic.co",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow (CAPEC-100) and reliably crash the application or cause significant resource exhaustion via a single crafted UDP packet with an invalid fragment sequence number."
    }
  ],
  "lastModified": "2026-06-17T09:59:02.050",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:elasticsearch:packetbeat:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D210516F-A232-4230-A069-E0955D91DCAC",
              "versionEndIncluding": "7.17.29",
              "versionStartIncluding": "7.0.0"
            },
            {
              "criteria": "cpe:2.3:a:elasticsearch:packetbeat:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A50D6282-69A2-4E91-A30F-A97D06F59159",
              "versionEndExcluding": "8.19.9",
              "versionStartIncluding": "8.0.0"
            },
            {
              "criteria": "cpe:2.3:a:elasticsearch:packetbeat:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D24C565F-FB26-4D8D-9963-58E77B7F7557",
              "versionEndExcluding": "9.1.9",
              "versionStartIncluding": "9.0.0"
            },
            {
              "criteria": "cpe:2.3:a:elasticsearch:packetbeat:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7BFB3597-387F-439B-8AE2-AA97239DAE49",
              "versionEndExcluding": "9.2.3",
              "versionStartIncluding": "9.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@elastic.co"
}