Description

An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofed TCP FIN packets without validating the sequence or acknowledgment numbers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-26T21:16:37.937Z",
  "pubdate": "2026-08-26T21:16:37.937Z",
  "executiveSummary": "The Vanderbilt Industries Acre Security SPC5300.000 Main Board v.3.14.1 is susceptible to a denial-of-service (DoS) vulnerability originating from improper TCP state management.\nThe vulnerability allows a physically proximate attacker to disrupt system availability by injecting malformed or spoofed TCP FIN packets.\nBecause the device fails to validate TCP sequence numbers and acknowledgment numbers during the FIN packet processing stage, the target system prematurely terminates established sessions or crashes the network stack.\nThis flaw impacts the availability of the security controller, potentially disabling critical security management functions managed by the board.\nExploitation requires physical proximity to the network segment, as the attacker must be capable of injecting crafted packets into the communication stream between the device and its peers.\nSuccessful exploitation results in service disruption, requiring a manual restart or recovery of the device to restore operational status.",
  "technicalDetails": "The vulnerability resides within the TCP/IP stack implementation of the Acre Security SPC5300.000 Main Board (v.3.14.1). The root cause is the failure of the network processing logic to enforce RFC-compliant sequence and acknowledgment number validation when handling FIN (Finish) control packets.\nUnder normal TCP operation, a FIN packet is used to initiate a graceful connection termination. A compliant implementation must verify that the sequence number within the FIN packet matches the expected next sequence number for the active connection. By failing to perform this validation, the target device accepts unsolicited or spoofed FIN packets regardless of their synchronization state.\nThe attack flow proceeds as follows: First, the attacker establishes or observes an active TCP connection between the SPC5300 device and a host. Second, the attacker crafts a malicious TCP packet with the FIN flag set. Third, the attacker injects this packet into the network path, spoofing the source address of the legitimate peer or simply transmitting the frame with an arbitrary sequence number.\nBecause the SPC5300 lacks state verification for these packets, it transitions the connection state to a closed or time-wait state immediately upon receiving the malicious frame, regardless of the validity of the sequence number field. If the attacker targets multiple connections or performs a rapid injection of these packets, the network stack can become overwhelmed or enter an inconsistent state, leading to a denial-of-service condition.\nThe exploitation is constrained by the requirement for physical proximity, as the attacker needs to be on the local network to successfully inject packets into the device's traffic stream without interference from higher-level routing security or stateful inspection firewalls. No authentication or privileged access is required to transmit these packets. Post-exploitation, the device becomes unresponsive to legitimate commands until the network session is reset or the hardware is power-cycled, effectively neutralizing the security board's ability to manage access control or monitor physical assets."
}