CVE-2004-0230: TCP sequence number guessing enables RST-based denial of service on long-lived connections

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityRemote, unauthenticated, low-complexity denial of service against long-lived connections with very high EPSS and public exploit references, though impact is availability-only and no KEV listing exists.

What it is

TCP implementations using a large window size make it easier for remote attackers to guess sequence numbers and inject spoofed TCP RST packets, terminating persistent connections. The flaw matters most for long-lived sessions such as BGP peering, where a dropped connection causes routing disruption rather than a simple client retry.

Impact

An attacker can cause connection loss (denial of service) on targeted persistent TCP sessions. There is no confidentiality or integrity impact per the CVSS vector; the effect is availability loss only.

Attack surface

Reachable remotely over the network with no authentication and no user interaction (AV:N/AC:L/Au:N). The attacker only needs to send spoofed TCP RST packets toward an established connection, which is easier when the connection uses a large window size.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.803 probability, 99.6th percentile) and one reference is tagged Exploit, indicating public exploit material exists. No ransomware group usage is documented.

What to do

• Apply vendor patches for the affected TCP stacks (Juniper, Microsoft, Oracle/Solaris, NetBSD, SCO, McAfee, OpenPGP) before other measures.
• Reduce TCP window sizes or enable TCP MD5 / TCP-AO authentication on long-lived sessions such as BGP to make spoofed RST injection harder.
• Filter spoofed traffic at network edges using BCP 38 / uRPF and restrict who can send packets toward routing peers.
• Where supported, enable TCP sequence number randomization and other stack hardening options.
• Monitor and rate-limit RST traffic toward critical long-lived connections.

Detection

• Alert on unexpected TCP RST packets terminating long-lived sessions, especially BGP peering resets.
• Baseline and monitor BGP session flaps and correlate them with RST bursts from unexpected source addresses.
• Use flow or packet capture to detect RST packets whose source addresses do not match legitimate peers.
• Track repeated connection teardowns on persistent TCP services for signs of repeated injection attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.