CVE-2018-25239

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2018-25239
Smart VPN 1.1.3.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input through the search interface. Attackers can paste a buffer of 2100 characters into the top right search bar to trigger an unhandled exception that crashes the application.

6.2 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.exploit-db.com/exploits/46272
https://www.microsoft.com/store/productId/9NH1G93D4HKR
https://www.vulncheck.com/advisories/smart-vpn-denial-of-service-via-search
Configurations

No configuration.

History

21 Jul 2026, 07:10

Type Values Removed Values Added
Summary
  • (es) Smart VPN 1.1.3.0 contiene una vulnerabilidad de denegación de servicio que permite a atacantes locales bloquear la aplicación al enviar una entrada de tamaño excesivo a través de la interfaz de búsqueda. Los atacantes pueden pegar un búfer de 2100 caracteres en la barra de búsqueda superior derecha para activar una excepción no controlada que bloquea la aplicación.

04 Apr 2026, 20:16

Type Values Removed Values Added
References
  • {'url': 'https://www.vulncheck.com/advisories/microsoft-smart-vpn-denial-of-service-via-search', 'source': 'disclosure@vulncheck.com'}
  • () https://www.vulncheck.com/advisories/smart-vpn-denial-of-service-via-search -

04 Apr 2026, 17:16

Type Values Removed Values Added
Summary (en) Microsoft Smart VPN 1.1.3.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input through the search interface. Attackers can paste a buffer of 2100 characters into the top right search bar to trigger an unhandled exception that crashes the application. (en) Smart VPN 1.1.3.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input through the search interface. Attackers can paste a buffer of 2100 characters into the top right search bar to trigger an unhandled exception that crashes the application.

04 Apr 2026, 14:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-04 14:16

Updated : 2026-07-21 07:10

NVD link : CVE-2018-25239

Mitre link : CVE-2018-25239

CVE.ORG link : CVE-2018-25239

JSON object : View

Products Affected

No product.

CWE
CWE-470

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')