CVE-2024-5949: Deep Sea Electronics DSE855 · Infinite Loop
Affects Deep Sea Electronics DSE855Source CVE Database V5
Not known to be exploited · CVSS 4.3 Medium.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 47% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 13 Jun 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Deep Sea Electronics DSE855 | Affected
| Fixed in– |
AI-suggested
Given the absence of an official patch, organizations should implement immediate network-level mitigations. These include isolating DSE855 devices within segmented and controlled network zones to limit exposure to untrusted or less secure network segments. Deploy intrusion detection or prevention systems (IDS/IPS) with custom rules to detect and block malformed multipart boundary traffic that could trigger the infinite loop. Regularly monitor device logs and network traffic for anomalies indicative of attempted exploitation. Restrict network access to the devices to only trusted management systems and personnel. Engage with Deep Sea Electronics for updates and apply patches promptly once available. Additionally, consider implementing redundant systems or failover mechanisms to maintain operational continuity in case of device failure. Conduct security assessments and penetration testing focused on multipart boundary handling to identify potential attack vectors within the network environment.
Description
Deep Sea Electronics DSE855 Multipart Boundary Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of multipart boundaries. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-23171.