CVE-2018-25239
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Smart VPN 1.1.3.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input through the search interface. Attackers can paste a buffer of 2100 characters into the top right search bar to trigger an unhandled exception that crashes the application.
Risk Assessment
The risk is that a local attacker can intentionally crash the Smart VPN application, leading to service disruption and potential downtime for users relying on the VPN.
Recommendation
It is recommended to update Smart VPN to the latest version that includes a fix limiting input length in the search field, or implement input validation on the server side.
Original NVD description (English source)
Smart VPN 1.1.3.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input through the search interface. Attackers can paste a buffer of 2100 characters into the top right search bar to trigger an unhandled exception that crashes the application.