Description

An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via Spoofed SYN packets.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-26T21:16:37.703Z",
  "pubdate": "2026-08-26T21:16:37.703Z",
  "executiveSummary": "A vulnerability has been identified in the Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1, involving a denial-of-service (DoS) condition.\nThe vulnerability is triggered by a physically proximate attacker injecting spoofed SYN packets into the network interface of the main board.\nThe primary impact is the loss of availability for the SPC5300 system, effectively disrupting the security controller's operations and potentially impacting connected security infrastructure.\nThis vulnerability necessitates physical proximity, implying the attacker must have access to the local network segment or physical link connected to the SPC5300 device.\nThe risk is categorized as a service disruption, where the device becomes unresponsive to legitimate traffic or management commands due to resource exhaustion or stack overflow caused by the malicious SYN flooding.\nNo authentication is required for an attacker to initiate this attack, provided they can reach the target device on the local network.",
  "technicalDetails": "The vulnerability resides within the network stack of the Acre Security SPC5300.000 Main Board v.3.14.1, specifically in its handling of TCP connection initiation requests.\nThe root cause is an inefficient or unhardened implementation of the TCP three-way handshake mechanism, specifically failing to properly manage or limit the processing of incoming SYN (Synchronize) packets.\nBy transmitting a high volume of spoofed SYN packets, a physically proximate attacker can exhaust the system's Transmission Control Block (TCB) table or consume insufficient CPU cycles allocated for network stack processing.\nWhen the SPC5300 receives a flood of these packets, it attempts to allocate resources for each connection attempt, expecting a subsequent ACK (Acknowledgment) that never arrives from the spoofed sources. This effectively puts the target in a half-open state for a large number of connections.\nThe exploitation flow proceeds as follows: 1. The attacker gains access to the local network segment where the SPC5300 device resides. 2. The attacker utilizes a packet generation tool to craft and flood the target IP address with SYN packets using randomized, non-existent source IP addresses. 3. The SPC5300 attempts to respond with SYN-ACK packets, creating entries in its memory to track these states. 4. Due to the lack of adequate rate limiting or aggressive session timeout mechanisms, the connection tracking table or system buffer is saturated. 5. The device ceases to process legitimate network traffic, resulting in a state where the management interface and control functions become unresponsive, effectively inducing a denial-of-service condition.\nThis vulnerability is particularly concerning for critical infrastructure components like the SPC5300, as the disruption of the main board can lead to the failure of secondary security operations monitored or managed by the system. The lack of robust validation of source integrity or session management within the device firmware remains the primary technical constraint leading to this exploitability."
}