Secure Access CVE-2025-49080

This vulnerability presents HIGH real-world risk despite a moderate CVSS v3.1 base score of 7.5. Risk signal analysis: (1) Attack Vector (AV:N) + Attack Complexity (AC:L) + No Privileges (PR:N) + No User Interaction (UI:N) = trivially exploitable from the network with no prerequisites; (2) Availability impact (A:H) means complete service outage is achievable; (3) CVSS Scope (S:U) indicates impact is limited to the vulnerable component itself, not system-wide; (4) Wide version range affected (9.0-13.54) suggests large installed base at risk; (5) Likely active exploitation or imminent POC development given the straightforward packet-based attack vector and low complexity. The absence of confidentiality and integrity impact (C:N/I:N) prevents this from reaching critical severity, but for organizations relying on Absolute Secure Access for business continuity, a DoS vulnerability is operationally critical. EPSS score would likely be elevated (>0.80) due to low attack complexity and network accessibility, making this a priority for rapid patching.

An attacker with network access to the Absolute Secure Access server (e.g., on the same network segment or via the internet if the server is internet-facing) crafts a series of malformed or oversized packets designed to trigger the memory management flaw in the packet parsing code. The attacker sends these packets to the server's listening port without authentication. The flawed loop condition validation allows the packet handler to allocate excessive memory, fail to deallocate memory properly, or write beyond buffer boundaries. After sending a small number of specially crafted packets (seconds to minutes), the server process exhausts available memory or encounters a fatal memory access violation, crashing and becoming unavailable. The attacker can repeat this attack to maintain the denial of service. No proof-of-concept code is required—the low complexity attack surface means exploitation is straightforward reverse-engineering from the vulnerable code path, and POC tools will likely circulate within 48–72 hours of public disclosure if not already being leveraged in targeted campaigns.