Netgear RAX30 Denial-of-Service Vulnerability Due to Misconfigured USERLIMIT_GLOBAL Option

A denial-of-service vulnerability has been identified in the Netgear RAX30 router, specifically in version V1.0.10.94_3. The issue arises because the USERLIMIT_GLOBAL option is set to 0 in several bftpd-related configuration files, allowing unlimited users to connect. This misconfiguration can lead to denial-of-service attacks, as the server may become overwhelmed with connections, even though clients are disconnected after a short period.

Impact

Exploitation of this vulnerability can lead to denial-of-service conditions, where the router becomes overwhelmed with connections, potentially causing legitimate users to be disconnected or unable to connect.