CVE-2008-1311: PacketTrap pt360 Tool Suite PRO TFTP server input validation DoS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

medium priorityThe flaw is remotely exploitable without authentication and has public exploit references, but it only causes a denial of service with no confidentiality or integrity impact, and the CVSS base score is 5.0 (Medium).

What it is

The TFTP server in PacketTrap pt360 Tool Suite PRO 2.0.3901.0 and earlier fails to validate uploaded filenames, allowing a remote attacker to hang the daemon by uploading files named with a pipe, quotation mark, angle brackets, or an overly long name. The flaw is an improper input validation issue (CWE-20) that affects availability of the TFTP service.

Impact

An unauthenticated remote attacker can cause a denial of service by hanging the TFTP daemon, disrupting file transfer services on the affected host. No confidentiality or integrity impact is described.

Attack surface

Reachable over the network via the TFTP service (AV:N, AC:L, Au:N); no authentication or user interaction is required, as the attacker only needs to send a crafted upload request with a malicious filename.

Exploitation

Not listed in CISA KEV, but public exploit references exist (SecurityFocus BID 28187 and an aluigi.org test tool tagged Exploit), and EPSS is 0.49167 (98.8th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Apply the vendor fix or upgrade PacketTrap pt360 Tool Suite PRO beyond version 2.0.3901.0 if an update is available.
• Restrict network access to the TFTP service to trusted hosts only, using firewall rules or ACLs.
• Disable the TFTP server component if it is not required for operations.
• Monitor for and block uploads with filenames containing pipe, quotation mark, angle brackets, or excessive length at the network or application layer.

Detection

• Inspect TFTP upload traffic for filenames containing '|', '"', '<', '>', or unusually long names.
• Monitor TFTP daemon availability and restart events for unexplained hangs.
• Review network logs for repeated TFTP write requests from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.