CVE-2025-9649

appneta tcpreplay send_packets.c calc_sleep_time divide by zero

4.8 MediumFix available

A security vulnerability has been detected in appneta tcpreplay 4.5.1. Impacted is the function calc_sleep_time of the file send_packets.c. Such manipulation leads to divide by zero. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. Upgrading to version 4.5.3-beta3 is recommended to address this issue. It is advisable to upgrade the affected component. The vendor confirms in a GitHub issue reply: "Was able to reproduce in 6fcbf03 but NOT 4.5.3-beta3."

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

0.26%Up 0.2 points since Aug 30, 2025

What each source reports

CVE List Score used 4.8

appneta tcpreplay send_packets.c calc_sleep_time divide by zero

Record: CVE-2025-9649
CVSS 4.0: 4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CVSS 3.0: 3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CVSS 2.0: 1.7 AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C
Weakness: CWE-369, CWE-404
Updated: 2026-11-02

EUVDEUVD-2025-26193 4.8

Record: EUVD-2025-26193
CVSS 4.0: 4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Updated: 2026-11-02

GitHub AdvisoriesGHSA-cgx8-mh65-hcp4 1.9

A security vulnerability has been detected in appneta tcpreplay 4.5.1. Impacted is the function...

Record: GHSA-cgx8-mh65-hcp4
CVSS 4.0: 1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-369
Updated: 2026-11-02

NVD 1.9

Record: CVE-2025-9649
CVSS 4.0: 1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 1.7 LowAV:L/AC:L/Au:S/C:N/I:N/A:P
Weakness: CWE-369, CWE-404
Updated: 2026-11-02

OSV 1.9

appneta tcpreplay send_packets.c calc_sleep_time divide by zero

Record: CVE-2025-9649
CVSS 4.0: 1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Weakness: CWE-369, CWE-404
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-9649 5.5

Record: DEBIAN-CVE-2025-9649
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-9649 1.9

Record: UBUNTU-CVE-2025-9649
CVSS 4.0: 1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVopenSUSE-SU-2025:20119-1 No score

Security update for tcpreplay

This update for tcpreplay fixes the following issues:

update to 4.5.2:
- features added since 4.4.4
  - fix/recalculate header checksum for ipv6-frag
  - IPv6 frag checksum support
  - AF_XDP socket support
  - tcpreplay -w (write into a pcap file)
  - tcpreplay --fixhdrlen
  - --include and --exclude options
  - SLL2 support
  - Haiku support
- security fixes reported for 4.4.4 fixed in 4.5.2
  - CVE-2023-4256 / bsc#1218249
  - CVE-2023-43279 / bsc#1221324
  - CVE-2024-3024 / bsc#1222131 (likely)
  - CVE-2024-22654 / bsc#1243845
  - CVE-2025-9157 / bsc#1248322
  - CVE-2025-9384 / bsc#1248595
  - CVE-2025-9385 / bsc#1248596
  - CVE-2025-9386 / bsc#1248597
  - CVE-2025-9649 / bsc#1248964
  - CVE-2025-51006 / bsc#1250356

Record: openSUSE-SU-2025:20119-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`tcpreplay` Debian:12	All versions, plus listed versions 4.4.3-14.4.4-14.5.1-14.5.2-14.5.3-14.5.4-1	None known
`tcpreplay` Debian:13	All versions, plus listed versions 4.5.1-14.5.2-14.5.3-14.5.4-1	None known
`tcpreplay` Debian:14	before 4.5.2-1, plus listed versions 4.5.1-1	4.5.2-1
`tcpreplay` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 3.4.4-23.4.4-2+deb8u1build0.16.04.13.4.4-2+deb8u1ubuntu0.1~esm13.4.4-2+deb8u1ubuntu0.1~esm23.4.4-2+deb8u1ubuntu0.1~esm3	None known
`tcpreplay` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 4.2.6-14.2.6-1ubuntu0.1~esm14.2.6-1ubuntu0.1~esm24.2.6-1ubuntu0.1~esm34.2.6-1ubuntu0.1~esm44.2.6-1ubuntu0.1~esm5	None known
`tcpreplay` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 4.3.2-1build14.3.2-1ubuntu0.1~esm14.3.2-1ubuntu0.1~esm24.3.2-1ubuntu0.1~esm3	None known
`tcpreplay` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 4.3.3-24.3.4-14.3.4-1ubuntu0.1~esm14.3.4-1ubuntu0.1~esm2	None known
`tcpreplay` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 4.4.3-14.4.4-14.4.4-1build14.4.4-1build24.4.4-1ubuntu0.1~esm1	None known
`tcpreplay` Ubuntu:25.10	All versions, plus listed versions 4.5.1-14.5.2-1	None known
`tcpreplay` Ubuntu:26.10	All versions, plus listed versions 4.5.2-1build14.5.4-1	None known
`tcpreplay` Ubuntu:26.04:LTS	All versions, plus listed versions 4.5.2-14.5.2-1build1	None known
`tcpreplay` openSUSE:Leap 16.0 From an advisory covering 11 CVEs	before 4.5.2-bp160.1.1	4.5.2-bp160.1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-9649 is a medium vulnerability (CVSS 4.8) in Appneta Tcpreplay, published August 29, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in tcpreplay 4.5.2-1.

References

Show 28 moreShow less