Softing smartLink CVE-2025-10150

No special conditions - remote unauthenticated triggering against the embedded webserver on TCP port 80 of Softing smartLink HW-PN (1.02 through 1.03) and smartLink HW-DP (1.31) devices; merely scanning the port is sufficient to crash the service. The limiting factors are: (1) the attacker must have network reachability to port 80 on the device's management interface, so devices on isolated/segmented OT networks behind firewalls are far less exposed; and (2) impact is confined to availability (webserver denial of service) - there is no path to code execution, data disclosure, or integrity compromise.

This is a remote, unauthenticated denial-of-service flaw (CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N) in Softing Industrial Automation smartLink gateways, where simply scanning TCP port 80 crashes the embedded webserver. The 8.7 HIGH score is driven entirely by availability impact (VA:H, with SA:L on the subsequent system) - there is NO confidentiality or integrity impact (VC:N/VI:N). Signals are consistent but modest in urgency: EPSS is low at 0.26% (17th percentile), the CVE is NOT on CISA KEV, and no public POC is referenced, so there is no evidence of active exploitation. The paradox here is a low-complexity, no-privilege, no-interaction trigger (trivially reachable by any routine network scanner) combined with low exploitation-probability scoring - this reflects the limited payoff (service disruption only, no code execution or data exposure) and the niche OT/ICS product footprint rather than any difficulty of triggering it. The real-world concern is specific to availability-sensitive OT environments: because ordinary vulnerability/port scanning can inadvertently crash the device, the practical risk is operational disruption (including accidental self-inflicted outages during routine scanning), not attacker takeover. Treat as a moderate-priority patch for the affected industrial devices, especially where uptime is safety- or process-critical.

An attacker (or even a benign scanning tool) with network reachability to the gateway's management interface sends TCP traffic to port 80. The probe triggers a resource/deadlock condition (CWE-833) that crashes the webserver, rendering the device's web management interface unavailable until restart. No authentication, user interaction, or crafted exploit chain is required, and no public POC is identified at time of analysis.