The H3C GR2200 MiniGR1A0V100R016 device has a configuration vulnerability where the USERLIMIT_GLOBAL parameter in /etc/bftpd.conf is set to 0, effectively allowing unlimited concurrent user connections. This misconfiguration can be exploited to cause a denial of service by overwhelming the system with too many simultaneous connections. The vulnerability is identified as CWE-400 (Uncontrolled Resource Consumption). There is no information on available patches or fixes, and no known exploits in the wild have been reported as of the publication date.

The vulnerability allows an attacker to cause a denial of service condition by connecting an unlimited number of users to the affected service, potentially exhausting system resources and disrupting normal operation. There is no impact on confidentiality or integrity reported, only availability is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing external controls such as network-level rate limiting or connection throttling to mitigate the risk of resource exhaustion. Monitor for unusual connection patterns that may indicate exploitation attempts.