TRENDnet TPL-430AP Denial-of-Service Vulnerability Due to Misconfigured User Limit

A denial-of-service vulnerability has been identified in the TRENDnet TPL-430AP access point running firmware version 1.0. The issue arises because the 'USERLIMIT_GLOBAL' option in the bftpd-related configuration file is set to 0, allowing an unlimited number of users to connect. This misconfiguration can lead to denial-of-service attacks, as the server may become overwhelmed with connections, even though clients are disconnected after a short period.

Impact

Exploitation of this vulnerability can lead to denial-of-service conditions, where the device becomes overwhelmed with connections, potentially causing legitimate users to be disconnected or unable to connect.

Reproduction

The vulnerability can be reproduced by connecting an unlimited number of users to the TRENDnet TPL-430AP access point. The device will allow all connections, leading to a denial-of-service condition.