ID: MEDIUM-12

Title: Router susceptible to Denial of Service via high-rate packet flooding

Severity: Medium

CVSS Score: 6.5

CVSS Vector String: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description: The router was found to be susceptible to denial of service through high-rate packet flooding across multiple protocols. Flood attacks were performed using hping3 in ICMP, SYN, and UDP modes, each causing the web management interface to become unresponsive during the attack. In all three cases the interface recovered after the flood was stopped, confirming the condition is temporary but reliably reproducible. The router does not appear to implement SYN cookie protection, ICMP rate limiting, or any other flood mitigation mechanism sufficient to maintain availability under high packet rates. It is worth noting that a standard ping flood using the system ping utility with the -f flag, which transmitted 176,384 packets over approximately 23 seconds, did not cause any disruption, and the web interface remained fully accessible throughout. The denial of service condition therefore appears to require the higher packet rates achievable with hping3 in flood mode, suggesting the router has some baseline capacity but it is easily exceeded by a determined attacker on the LAN.

Remediation: Implement rate limiting for ICMP, TCP SYN, and UDP traffic. Enable SYN cookie protection to mitigate TCP SYN flood attacks. Consider implementing per-source rate limiting to prevent a single LAN host from saturating the router’s processing capacity.

More information: See Ethernet Testing chapter.