CVE-2023-4418

HighCVSS 7.5

Published: 24/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.69%

48th percentile - higher than 48% of all known CVEs

Summary

A remote unprivileged attacker can send multiple packages to the LMS5xx to disrupt its availability through a TCP SYN-based denial-of-service (DDoS) attack. By exploiting this vulnerability, an attacker can flood the targeted LMS5xx with a high volume of TCP SYN requests, overwhelming its resources and causing it to become unresponsive or unavailable for legitimate users.

Risk Assessment

This vulnerability poses a risk of disrupting the availability of the LMS5xx device, potentially leading to downtime in the operations of systems and services relying on it. A DDoS attack could impact organizational operations and user trust.

Recommendation

It is recommended to implement DDoS protection mechanisms and monitor network traffic to detect and mitigate unauthorized TCP SYN requests. Regular software updates for the device may also help secure against this vulnerability.

Other vulnerabilities in LMS5xx

CVE-2023-4419Critical
The LMS5xx uses hard-coded credentials, which potentially allow low-skilled unauthorized remote attackers to reconfigure settings and/or disrupt the functionality of the device.

Original NVD description (English source)

A remote unprivileged attacker can sent multiple packages to the LMS5xx to disrupt its availability through a TCP SYN-based denial-of-service (DDoS) attack. By exploiting this vulnerability, an attacker can flood the targeted LMS5xx with a high volume of TCP SYN requests, overwhelming its resources and causing it to become unresponsive or unavailable for legitimate users.