CVE-2018-25239

Smart VPN 1.1.3.0 Denial of Service via Search

CVSS 6.9 MEDIUMEPSS 0.2%CWE-470

Smart VPN 1.1.3.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input through the search interface. Attackers can paste a buffer of 2100 characters into the top right search bar to trigger an unhandled exception that crashes the application.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected products

SmartVPN · Smart VPN

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/46272unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.exploit-db.com/exploits/46272 https://www.microsoft.com/store/productId/9NH1G93D4HKR https://www.vulncheck.com/advisories/smart-vpn-denial-of-service-via-search