EUVD-2025-18200Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
There is a memory management vulnerability in Absolute Secure Access server versions 9.0 to 13.54. Attackers with network access to the server can cause a Denial of Service by sending a specially crafted sequence of packets to the server. The attack complexity is low, there are no attack requirements, privileges, or user interaction required. Loss of availability is high; there is no impact on confidentiality or integrity.
AnalysisAI
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated, network-based attackers to trigger a Denial of Service condition by sending specially crafted packet sequences. The vulnerability requires no privileges or user interaction and has high availability impact (complete service disruption), though no data confidentiality or integrity risk. This is a critical operational risk for organizations dependent on Absolute Secure Access for remote connectivity.
Technical ContextAI
The vulnerability stems from CWE-762 (Mismatched Validation of Loop Condition), a memory management flaw in the Absolute Secure Access server's packet handling logic. The affected technology is Absolute Secure Access (CPE: cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:*), a remote connectivity and access control solution. The memory management defect exists in versions 9.0 through 13.54, suggesting the flaw was introduced or remained unpatched across multiple major release cycles. The root cause involves improper validation of loop conditions during packet processing, likely resulting in unbounded memory consumption, buffer exhaustion, or unsafe memory access that crashes the service. The network-accessible attack surface (AV:N) indicates the vulnerable code path is directly reachable from unauthenticated network connections, typical of server socket handlers or protocol parsers.
More in Secure Access
View allPersistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep,
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-p
Local privilege escalation in Absolute Secure Access Windows client versions prior to 14.50 allows authenticated local a
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthentica
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel parti
Buffer overflow in Absolute Secure Access server (versions before 14.50) allows authenticated remote attackers with modi
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticat
Non-persistent denial-of-service against Absolute Secure Access servers prior to version 14.55 is achievable by an attac
Memory management flaw in Absolute Secure Access prior to version 14.55 allows a remote attacker with deep protocol know
Memory corruption in Absolute Secure Access Windows clients prior to version 14.50 allows local authenticated attackers
Buffer overflow in Absolute Secure Access Windows client versions prior to 14.50 allows local attackers with high privil
Same weakness CWE-762 – Mismatched Memory Management Routines
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today