CVE-2025-2813: HTTP Service Port 80 DOS Vulnerability

CVE-2025-2813 Overview

CVE-2025-2813 is a denial of service vulnerability affecting an HTTP service exposed on TCP port 80. An unauthenticated remote attacker can disrupt service availability by sending a large volume of HTTP requests to the targeted device. The flaw is classified under CWE-770, Allocation of Resources Without Limits or Throttling. The vulnerability was disclosed through CERT VDE Advisory VDE-2025-029.

Critical Impact
Remote, unauthenticated attackers can exhaust HTTP service resources and render the affected device unreachable, impacting operational availability.

Affected Products

Devices referenced in CERT VDE Advisory VDE-2025-029
HTTP service listening on TCP port 80
Specific product and version details: refer to the vendor advisory

Discovery Timeline

2025-07-31 - CVE-2025-2813 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-2813

Vulnerability Analysis

The vulnerability resides in the HTTP service listening on TCP port 80. The service fails to enforce limits on the volume or rate of inbound requests it will accept and process. An unauthenticated remote attacker can issue a high volume of HTTP requests, consuming connection, memory, or processing resources on the device.

Once resource limits are reached, legitimate clients can no longer establish connections or receive timely responses. The condition persists for the duration of the flood and can require operator intervention or device reset to restore service. Confidentiality and integrity are not affected, but availability is fully impacted.

Root Cause

The root cause is missing or insufficient rate limiting and resource allocation controls in the HTTP service implementation [CWE-770]. The service accepts and processes requests without enforcing per-client connection caps, request rate ceilings, or queue length limits. Refer to the CERT VDE Advisory VDE-2025-029 for technical details specific to the affected product.

Attack Vector

The attack is conducted remotely over the network. The attacker requires no authentication, no user interaction, and only network reachability to TCP port 80 on the target device. A sustained flood of HTTP requests from one or more sources is sufficient to trigger the condition.

No verified exploit code or proof-of-concept has been published for this CVE. The technique relies on generic HTTP request flooding rather than a product-specific exploit primitive.

Detection Methods for CVE-2025-2813

Indicators of Compromise

Sudden spikes in inbound TCP connections to port 80 on affected devices
HTTP request rates from a single source IP that exceed normal operational baselines
Loss of management plane availability or unresponsive web interfaces on the affected device
Connection table exhaustion or memory pressure alerts on the device

Detection Strategies

Baseline normal HTTP request volumes per device and alert on sustained deviations
Monitor TCP connection state counts to port 80 and flag abnormal SYN or established connection growth
Correlate device health metrics such as CPU and memory utilization with inbound HTTP traffic patterns
Inspect HTTP access logs for repetitive request patterns originating from a small set of source addresses

Monitoring Recommendations

Forward device telemetry, NetFlow, and HTTP logs to a centralized analytics platform for correlation
Configure threshold alerts for HTTP requests per second and concurrent connections per source IP
Track device reachability with active probes to detect availability loss caused by the flood
Maintain alerting on perimeter firewalls and load balancers for volumetric anomalies targeting port 80

How to Mitigate CVE-2025-2813

Immediate Actions Required

Restrict access to TCP port 80 on affected devices to trusted management networks only
Place affected devices behind a reverse proxy or load balancer that enforces rate limiting
Apply vendor-supplied firmware or software updates as referenced in CERT VDE Advisory VDE-2025-029
Disable the HTTP service on port 80 if it is not required for operations

Patch Information

Consult the CERT VDE Advisory VDE-2025-029 for the authoritative list of affected products, fixed versions, and remediation guidance from the vendor. No CISA KEV listing exists for this CVE at the time of publication, and no public exploit has been observed.

Workarounds

Apply network-level access control lists to limit inbound connections to port 80 to authorized hosts
Deploy upstream rate limiting on firewalls, load balancers, or web application firewalls
Segment affected devices onto a management VLAN isolated from untrusted networks
Use TCP connection limits per source IP on intermediate network devices to throttle floods

bash

# Configuration example: iptables rate limit on inbound HTTP
iptables -A INPUT -p tcp --dport 80 -m conntrack --ctstate NEW \
  -m limit --limit 30/minute --limit-burst 50 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -m conntrack --ctstate NEW -j DROP