EUVD-2025-17128
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Lifecycle Timeline
6DescriptionNVD
Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The device is vulnerable to a packet flooding denial of service attack.
AnalysisAI
CVE-2025-41360 is an uncontrolled resource consumption vulnerability affecting IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04 that enables remote denial of service through packet flooding attacks. The vulnerability allows unauthenticated network attackers to exhaust device resources with minimal complexity, resulting in service unavailability. The high CVSS score of 8.7 reflects the critical availability impact, though exploitation requires network access and no privilege escalation is possible.
Technical ContextAI
This vulnerability stems from CWE-400 (Uncontrolled Resource Consumption), a class of flaws where applications fail to implement proper rate limiting, input validation, or resource throttling mechanisms. The affected products—IDF (Intelligent Device Framework) v0.10.0-0C03-03 and ZLF (likely a protocol or firmware layer) v0.10.0-0C03-04—lack sufficient packet handling controls that would normally drop, rate-limit, or queue incoming network traffic. When subjected to high-volume packet floods, the device's network processing engine, memory buffers, or CPU resources become exhausted, causing the legitimate service to become unresponsive. The vulnerability is network-exploitable (AV:N), requires no authentication (PR:N) or user interaction (UI:N), and operates at the transport or application layer where packet validation should occur.
RemediationAI
- Immediate Mitigation: Deploy network-level rate limiting and packet filtering at upstream firewalls or edge routers to drop excessive traffic from single sources (e.g., SYN flood protection, UDP rate limits). Implement ingress filtering (BCP 38) to block spoofed packets. 2. Patching: Upgrade IDF to a patched version > 0.10.0-0C03-03 and ZLF to > 0.10.0-0C03-04 once vendor releases are available. Contact the vendor (product ownership unclear from provided data) for patch availability timelines. 3. Configuration Hardening: Enable any device-level resource management features (packet queue limits, CPU throttling, memory limits) if available in product documentation. 4. Monitoring: Implement alerting for sustained packet flooding patterns, connection table exhaustion, or CPU spike indicators specific to the device platform. 5. Workaround: If patching is delayed, isolate affected devices to trusted networks or behind DDoS mitigation appliances until patched.
Share
External POC / Exploit Code
Leaving vuln.today