CVE-2025-44652
BaseFortify
Publication date: 2025-07-21
Last updated on: 2025-08-07
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| netgear | rax30 | v1.0.10.94_3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Netgear RAX30 router firmware version V1.0.10.94_3, where the USERLIMIT_GLOBAL option in the bftpd (FTP daemon) configuration is set to 0. This setting allows unlimited simultaneous user connections, which is a misconfiguration. Because of this, an attacker can exploit the unlimited connections to overwhelm the server, causing a denial-of-service (DoS) attack. [1]
How can this vulnerability impact me? :
The vulnerability can impact you by allowing attackers to connect an unlimited number of users simultaneously to the FTP service on the Netgear RAX30 router. This can overwhelm the server resources, leading to denial-of-service (DoS) conditions where legitimate users may be disconnected or unable to access the service. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking the bftpd configuration file on the Netgear RAX30 router, specifically the /etc/bftpd.conf file. Look for the USERLIMIT_GLOBAL parameter and verify if it is set to 0, which allows unlimited concurrent user connections and indicates the vulnerability. A command to check this setting could be: `grep USERLIMIT_GLOBAL /etc/bftpd.conf`. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately change the USERLIMIT_GLOBAL setting in the /etc/bftpd.conf file from 0 to a reasonable limit between 5 and 20 concurrent users. This limits the number of simultaneous user logins and prevents denial-of-service attacks caused by unlimited connections. After changing the configuration, restart the bftpd service to apply the changes. [1]