TRENDnet TPL-430AP CVE-2025-44651

The specific prerequisite is that the device's embedded bftpd FTP service is running and reachable over the network, with its shipped configuration where USERLIMIT_GLOBAL=0 removes the concurrent-connection cap - that misconfiguration IS the vulnerable condition and is the default on FW1.0. Per the CVSS vector, no authentication (PR:N) and no user interaction (UI:N) are required, and complexity is low (AC:L). Limiting factors that constrain realistic risk: the attacker must have network/TCP reachability to the FTP port, which on a typical LAN-deployed powerline access point means being on the local or adjacent network unless FTP is deliberately internet-exposed; the impact is limited to denial of service (A:H only, no C/I impact) and is recoverable via device restart; and it is confined to the single TPL-430AP FW1.0 model.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: a network-reachable FTP service with no connection cap can be flooded with low effort and no authentication, producing a pure availability (A:H) impact and no confidentiality or integrity effect. However, the real-world priority is materially lower than the 7.5 'High' suggests. EPSS is only 0.52% (40th percentile), the CVE is NOT in CISA KEV (no confirmed active exploitation), and the impact is a recoverable denial of service on a niche consumer/SMB powerline device rather than code execution or data loss. A key limiting factor not captured by AV:N is exposure: exploitation requires network reachability to the device's FTP port, which on a typical LAN-only powerline AP deployment means an attacker must already be on the local/adjacent network unless the device's FTP service is deliberately exposed to the internet. Net assessment: a genuine but low-to-moderate priority - patch on maintenance cadence, prioritize only where the device's FTP port is externally or broadly reachable.

An attacker with network access to the access point's FTP port scripts a loop that repeatedly opens new bftpd connections without closing them; because USERLIMIT_GLOBAL=0 enforces no cap, the daemon accepts every session until the device exhausts memory and descriptors and stops responding. Given AV:N/AC:L/PR:N/UI:N, this requires only a trivial connection-flooding tool and no credentials or user interaction; a researcher gist documenting the issue exists, but no confirmed weaponized exploit is published.