Monthly
Denial of service in SAUTER devices exposing the wscserver SOAP/web-services interface allows unauthenticated remote attackers to crash the server process by sending incomplete SOAP requests. Because no watchdog restarts wscserver, recovery requires a manual device reboot, making the availability impact lasting despite the high-only CVSS vector. No public exploit was identified at time of analysis, and EPSS is low at 0.47% (40th percentile).
On Microchip RN4870 devices, when more than one consecutive PairReqNoInputNoOutput request is received, the device becomes incapable of completing the pairing process. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, effectively blocking the access to the dashboard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Denial of service in SAUTER devices exposing the wscserver SOAP/web-services interface allows unauthenticated remote attackers to crash the server process by sending incomplete SOAP requests. Because no watchdog restarts wscserver, recovery requires a manual device reboot, making the availability impact lasting despite the high-only CVSS vector. No public exploit was identified at time of analysis, and EPSS is low at 0.47% (40th percentile).
On Microchip RN4870 devices, when more than one consecutive PairReqNoInputNoOutput request is received, the device becomes incapable of completing the pairing process. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, effectively blocking the access to the dashboard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.