| tiêu đề | TRENDnet TEW-816DRM TEW-816DRM GURNC4.OT182B-C-TN-R1B028-US.EN (2018-05-16) Misconfiguration |
|---|
| Mô tả | **Description:** In TEW-816DRM GURNC4.OT182B-C-TN-R1B028-US.EN (2018-05-16), the `USERLIMIT_GLOBAL` property is set to 0 in the `bftpd`-related configuration file. This can cause DoS attacks when unlimited users are connected.
**Detail:**
In the `TEW-816DRM GURNC4.OT182B-C-TN-R1B028-US.EN (2018-05-16)` firmware, the partial content of `/etc/bftpd.conf` is as follows.
```
#The number of users that can be logged in at the same time.
#If set to "0", an unlimited users will be able to connect. This is not
#recommended, as it makes DoS attacks possible, even if the clients are
#kicked after a short time.
USERLIMIT_GLOBAL="0"
```
The official documentation of bftpd (https://bftpd.sourceforge.net/doc/en/bftpddoc-en-6.html) states the following requirements.
```
Name: USERLIMIT_GLOBAL
Description: The number of users that can be logged in at the same time. If set to "0", an unlimited users will be able to connect. This is not recommended, as it makes DoS attacks possible, even if the clients are kicked after a short time.
Values:
"0" - (zero) default. This is not recommended.
On most small servers, the connection limit should probably be below twenty ("20") but above five ("5").
```
Clearly, there is a misconfiguration vulnerability here. This can cause DoS attacks when unlimited users are connected. |
|---|
| Nguồn | ⚠️ https://app.notion.com/p/TEW-816DRM-GURNC4-OT182B-C-TN-R1B028-US-EN-2018-05-16-38b1f5ba989080759a1ee701542f1935?source=copy_link |
|---|
| Người dùng | L-14 (UID 98432) |
|---|
| Đệ trình | 26/06/2026 04:57 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 14/08/2026 09:02 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 389971 [TRENDnet TEW-816DRM GURNC4.OT182B-C-TN-R1B028-US.EN bftpd /etc/bftpd.conf USERLIMIT_GLOBAL Từ chối dịch vụ] |
|---|
| điểm | 20 |
|---|