CVE-2025-61480 in SPC5300.000 Main Board
Summary
by MITRE • 08/27/2026
An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofed TCP FIN packets without validating the sequence or acknowledgment numbers.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in Vanderbilt Industries' Acre Security SPC5300.000 Main Board, specifically within firmware version 3.14.1, represents a critical flaw in the device's network stack implementation regarding TCP connection termination handling. This issue stems from an insufficient validation of Transmission Control Protocol (TCP) control flags during the processing of incoming packets destined for active connections on the embedded system. Specifically, the operating system or networking library integrated into this security appliance fails to rigorously verify that the sequence and acknowledgment numbers in received TCP FIN packets align with the current state of the connection as tracked by its internal state machine. In a properly implemented TCP stack, when a device receives a packet claiming to terminate a connection via a FIN flag, it must cross-reference the sequence number against the expected next byte for transmission and ensure the acknowledgment number matches the last received data plus one. The absence of this validation logic allows an attacker who is physically proximate to the network interface to inject malformed or spoofed TCP packets that appear valid at lower layers but are logically inconsistent with the established connection state from a higher-layer perspective.
From a technical standpoint, this flaw aligns closely with CWE-20 Improper Input Validation and CWE-400 Uncontrolled Resource Consumption. By accepting FIN packets without verifying their sequence numbers, the device's TCP stack may incorrectly conclude that the remote peer has closed the connection or that the local side should terminate its end of the session prematurely. This misinterpretation can lead to a state desynchronization where the embedded system drops active sessions unexpectedly. In many embedded security appliances like the Acre Security unit, which likely handles critical access control or surveillance data streams, such unexpected termination disrupts ongoing communications between clients and servers managed by the device. The attacker does not need authentication credentials; physical proximity to the network port is sufficient to exploit this weakness, making it a significant risk in environments where untrusted actors might have temporary access to local networking infrastructure, such as during maintenance or in poorly secured lobby areas.
The operational impact of this vulnerability is primarily characterized by a denial of service condition affecting legitimate users and connected systems. When the device processes these spoofed FIN packets, it may abruptly close TCP connections that are actively transferring data or maintaining keep-alive states for monitoring services. This results in interrupted video streams, failed authentication attempts, or loss of telemetry data depending on the specific applications running over the affected network interfaces. For a security appliance, such disruptions can create blind spots during critical incidents, potentially allowing unauthorized access to go undetected if the connection drops before an alert is generated or logged. Furthermore, repeated exploitation could lead to resource exhaustion as the system attempts to re-establish connections or manage timeouts for sessions that were prematurely terminated, further degrading performance and stability of the main board's processing capabilities.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary solution is to apply any available firmware updates from Vanderbilt Industries that patch this specific TCP stack validation logic. If no update is immediately available, network-level mitigations should be implemented at upstream firewalls or intrusion prevention systems configured between the attacker's potential location and the Acre Security device. These security devices can be tuned to drop TCP packets with FIN flags if their sequence numbers do not match expected values for known active sessions on the protected interface. Additionally, enabling TCP SYN cookies can help mitigate some forms of connection exhaustion attacks, though it does not directly fix the state desynchronization caused by spoofed FINs. Administrators should also restrict physical access to network ports connected to this device and consider implementing port security features that limit MAC address learning or disable unused interfaces to reduce the attack surface available to physically proximate adversaries.