CVE-2025-44651
BaseFortify
Publication date: 2025-07-21
Last updated on: 2025-08-07
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| trendnet | tpl-430ap_firmware | 1.0 |
| trendnet | tpl-430ap | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the TRENDnet TPL-430AP device running firmware FW1.0 due to a misconfiguration in the bftpd FTP daemon configuration file. The USERLIMIT_GLOBAL parameter is set to 0, which means there is no limit on the number of simultaneous user logins allowed. This allows an unlimited number of users to connect at the same time, which can be exploited to overwhelm the server and cause denial-of-service (DoS) attacks. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers or excessive users to connect simultaneously without limit, potentially overwhelming the TRENDnet TPL-430AP device and causing it to become unavailable or unresponsive. This results in a denial-of-service (DoS) condition, disrupting normal operations and access to the device. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking the bftpd configuration file on the TRENDnet TPL-430AP device, specifically the /etc/bftpd.conf file. Look for the USERLIMIT_GLOBAL parameter and verify if it is set to "0", which indicates the vulnerability. A command to check this setting could be: `grep USERLIMIT_GLOBAL /etc/bftpd.conf`. If the output shows USERLIMIT_GLOBAL=0, the device is vulnerable. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately change the USERLIMIT_GLOBAL parameter in the /etc/bftpd.conf file from "0" to a value between 5 and 20, which is recommended for small servers. This limits the number of simultaneous user logins and prevents denial-of-service attacks caused by unlimited connections. After changing the configuration, restart the bftpd service to apply the changes. [1]