Description

C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-19T23:16:18.700Z",
  "pubdate": "2026-08-19T23:16:18.700Z",
  "executiveSummary": "A denial of service vulnerability exists within the C12.22 protocol dissector across multiple software versions. The flaw allows remote attackers to trigger application crashes by supplying malformed protocol data.\nThe vulnerability type is a protocol dissector crash resulting in a denial of service condition. The impact of successful exploitation includes the abrupt termination of the parsing application, disrupting network analysis and monitoring operations.\nAffected systems include versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 of the affected product containing the vulnerable C12.22 dissector implementation.\nThe risk implication is operational disruption, as crash vulnerabilities in core parsing engines typically require manual service restarts and can be leveraged for sustained availability degradation against monitoring infrastructure.\nAttacker capabilities require the ability to transmit crafted network traffic or capture files containing malicious C12.22 protocol payloads to the vulnerable parsing component.\nExploitation requirements include the processing of the malformed protocol data by a vulnerable dissector instance, either via live network capture ingestion or analysis of untrusted capture files.",
  "technicalDetails": "The vulnerability resides in the C12.22 protocol dissector component responsible for parsing ANSI C12.22 meter data communication packets.\nThe root cause stems from improper input validation and handling of malformed packet structures within the dissector logic, leading to memory corruption, null pointer dereference, or an out-of-bounds read condition that forces an exception and process termination.\nAffected versions comprise 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18.\nNetwork exposure depends on the deployment context of the parsing software, affecting systems processing untrusted network traffic streams or user-supplied packet capture files.\nAuthentication and privilege requirements are generally absent for the trigger mechanism if the parser processes live unauthenticated network feeds or opens arbitrary files provided by an external user.\nThe attack flow proceeds as follows: 1) The attacker crafts a malicious C12.22 packet containing structurally invalid fields, unexpected length parameters, or malformed data elements. 2) The target system ingests the malicious packet via live network capture or opens a malicious capture file. 3) The C12.22 protocol dissector attempts to parse the malformed data structures. 4) The parsing routine encounters conditions it fails to handle safely, triggering an unhandled exception or fatal assertion. 5) The host application crashes immediately, resulting in a denial of service.\nPayload behavior involves exploiting parsing assumptions within the dissector code without necessarily achieving arbitrary code execution, focusing strictly on causing application instability and termination.\nPost-exploitation impact is limited to the denial of service state, disrupting dependent workflows and automated analysis pipelines until the service is manually recovered."
}