EUVD-2025-18200Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
6DescriptionCVE.org
There is a memory management vulnerability in Absolute Secure Access server versions 9.0 to 13.54. Attackers with network access to the server can cause a Denial of Service by sending a specially crafted sequence of packets to the server. The attack complexity is low, there are no attack requirements, privileges, or user interaction required. Loss of availability is high; there is no impact on confidentiality or integrity.
AnalysisAI
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated, network-based attackers to trigger a Denial of Service condition by sending specially crafted packet sequences. The vulnerability requires no privileges or user interaction and has high availability impact (complete service disruption), though no data confidentiality or integrity risk. This is a critical operational risk for organizations dependent on Absolute Secure Access for remote connectivity.
Technical ContextAI
The vulnerability stems from CWE-762 (Mismatched Validation of Loop Condition), a memory management flaw in the Absolute Secure Access server's packet handling logic. The affected technology is Absolute Secure Access (CPE: cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:*), a remote connectivity and access control solution. The memory management defect exists in versions 9.0 through 13.54, suggesting the flaw was introduced or remained unpatched across multiple major release cycles. The root cause involves improper validation of loop conditions during packet processing, likely resulting in unbounded memory consumption, buffer exhaustion, or unsafe memory access that crashes the service. The network-accessible attack surface (AV:N) indicates the vulnerable code path is directly reachable from unauthenticated network connections, typical of server socket handlers or protocol parsers.
More in Secure Access
View allPersistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep,
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-p
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthentica
Buffer overflow in Absolute Secure Access server (versions before 14.50) allows authenticated remote attackers with modi
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel parti
Memory management flaw in Absolute Secure Access prior to version 14.55 allows a remote attacker with deep protocol know
Non-persistent denial-of-service against Absolute Secure Access servers prior to version 14.55 is achievable by an attac
Heap overflow in Absolute Security Secure Access client certificate parsing causes a local denial of service. Versions p
CVE-2025-54088 is an open-redirect vulnerability in Secure Access prior to version 14.10. Attackers with access to the c
Frameable content on the Absolute Secure Access server login page (versions prior to 14.55) enables clickjacking attacks
There is a cross-site scripting vulnerability in the Secure Access administrative UI of Absolute Secure Access prior to
There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prio
Same weakness CWE-762 – Mismatched Memory Management Routines
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today