The version of Wireshark installed on the remote Windows host is prior to 2.0.6. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-2.0.6 advisory.

  - epan/dissectors/packet-ipmi-trace.c in the IPMI trace dissector in Wireshark 2.x before 2.0.6 does not     properly consider whether a string is constant, which allows remote attackers to cause a denial of service     (use-after-free and application crash) via a crafted packet. (CVE-2016-7180)

  - epan/dissectors/packet-qnet6.c in the QNX6 QNET dissector in Wireshark 2.x before 2.0.6 mishandles MAC     address data, which allows remote attackers to cause a denial of service (out-of-bounds read and     application crash) via a crafted packet. (CVE-2016-7175)

  - epan/dissectors/packet-h225.c in the H.225 dissector in Wireshark 2.x before 2.0.6 calls snprintf with one     of its input buffers as the output buffer, which allows remote attackers to cause a denial of service     (copy overlap and application crash) via a crafted packet. (CVE-2016-7176)

  - epan/dissectors/packet-catapult-dct2000.c in the Catapult DCT2000 dissector in Wireshark 2.x before 2.0.6     does not restrict the number of channels, which allows remote attackers to cause a denial of service     (buffer over-read and application crash) via a crafted packet. (CVE-2016-7177)

  - epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in Wireshark 2.x before 2.0.6 does not ensure     that memory is allocated for certain data structures, which allows remote attackers to cause a denial of     service (invalid write access and application crash) via a crafted packet. (CVE-2016-7178)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Wireshark 2.0.x < 2.0.6 Multiple Vulnerabilities

medium Nessus Plugin ID 93518

Version 1.11

Version 1.10

Version 1.9

Version 1.11 May 2, 2026, 1:15 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202605020115
Version 1.10 Mar 30, 2026, 9:17 PM Logic Changes (modernized plugin) Plugin Feed: 202603302117
Version 1.9 Jan 23, 2026, 3:45 PM CVSSv2 score source (set to "CVE-2016-7180") Plugin Feed: 202601231545