CVE-2021-4467

Name of the Vulnerable Software and Affected Versions Positive Technologies MaxPatrol 8 (affected versions not specified) Positive Technologies XSpider (affected versions not specified)

Description The client communication service, listening on TCP port 2002, is susceptible to a remote denial-of-service condition. The service creates a new session identifier for each incoming connection but does not limit concurrent requests. An unauthenticated remote attacker can send repeated HTTPS requests to the service, leading to excessive session identifier allocation. This can cause session identifier collisions under load, resulting in the disconnection of active client sessions and service disruption.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.