CVE-2025-44651 affects TRENDnet TPL-430AP firmware version 1.0. The vulnerability arises because the USERLIMIT_GLOBAL option in the bftpd-related configuration file is set to 0, which means there is no limit on the number of concurrent users. This can be exploited to cause a denial of service by overwhelming the device with unlimited user connections. The CVSS v3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating a high impact on availability without compromising confidentiality or integrity. There are no known exploits in the wild and no vendor patch or advisory has been provided.

The vulnerability allows an attacker to cause a denial of service condition by connecting an unlimited number of users to the affected device, potentially exhausting system resources and disrupting normal operation. Confidentiality and integrity are not impacted according to the CVSS vector. The device becomes unavailable or unstable under attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider limiting access to the affected device to trusted networks or users to reduce exposure. Monitor device performance for signs of resource exhaustion. Do not rely on generic mitigations as the vulnerability is specific to the USERLIMIT_GLOBAL setting in the bftpd configuration.