CVE-2025-9177
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A denial-of-service security issue exists in the affected product and version, stemming from a high number of requests sent to the web server. This can cause a web server crash but does not impact I/O control or communication; a power cycle is required to recover the webpage.
Risk Assessment
An attacker can overwhelm the web server and cause it to crash, making the web interface unavailable. I/O control and communication are unaffected, but a manual power cycle is required.
Recommendation
Apply vendor patches and implement rate limiting and DoS protection for the web server. Monitor web server availability and consider network segmentation.
Other vulnerabilities in Web server
See all- CVE-2026-70381Medium
An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface. The accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.
- CVE-2025-41737High
Due to webserver misconfiguration, an unauthenticated remote attacker is able to read the source of PHP modules.
Original NVD description (English source)
A denial-of-service security issue exists in the affected product and version. The security issue stems from a high number of requests sent to the web server. This could result in a web server crash however; this does not impact I/O control or communication . A power cycle is required to recover and utilize the webpage.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS