CVE-2021-4467 Details

A remote denial-of-service vulnerability has been identified in Positive Technologies MaxPatrol 8 and XSpider, both versions through September 2020. The issue resides in the client communication service on TCP port 2002, where the service generates a new session identifier for each incoming connection without properly limiting concurrent requests. This flaw allows an unauthenticated remote attacker to repeatedly send HTTPS requests to the service, leading to excessive session identifier allocation. Under heavy load, collisions may occur, causing active client sessions to disconnect and disrupting the service.