Security readout for executives and security teams
Plain-English summary
CVE-2025-44653 is a denial-of-service risk in a reported H3C GR2200 firmware build. The FTP daemon configuration allows unlimited global users, which can exhaust device resources when many connections are opened.
Executive priority
Treat this as a high-priority availability issue for exposed network appliances. Prioritize internet-facing or externally reachable management interfaces first, then internal devices supporting critical operations.
Technical view
The source states H3C GR2200 MiniGR1A0V100R016 has USERLIMIT_GLOBAL set to 0 in /etc/bftpd.conf. The CVSS 3.1 score is 7.5, network exploitable, low complexity, unauthenticated, with high availability impact only.
Likely exposure
Exposure is most likely where H3C GR2200 devices running MiniGR1A0V100R016 have the bftpd FTP service reachable from untrusted networks. Structured affected-product metadata is incomplete in the provided CVE data.
Exploitation context
The CVE is not listed as KEV in the provided bundle, and no cited source establishes active exploitation. The issue is still operationally meaningful because unauthenticated network connection volume can affect availability.
Researcher notes
Evidence is limited to the CVE record and linked public references. The affected field is not normalized, but the title and description identify H3C GR2200 MiniGR1A0V100R016 and CWE-400 resource consumption.
Mitigation direction
- Check H3C or device vendor advisories for firmware updates or configuration guidance.
- Disable FTP if it is not operationally required.
- Restrict FTP access to trusted management networks only.
- Where vendor-supported, configure a finite global FTP user limit.
- Monitor devices for abnormal FTP connection volume or availability degradation.
Validation and detection
- Inventory H3C GR2200 devices and confirm firmware version MiniGR1A0V100R016.
- Review /etc/bftpd.conf for USERLIMIT_GLOBAL set to 0.
- Confirm FTP is not reachable from the public internet.
- Review device logs for unusual FTP connection spikes.
- Document whether vendor guidance or updated firmware is available.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-400: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-44653 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://gist.github.com/TPCchecker/1193f51fc870b597c8a59860199d50e4CVE reference, mitre
- https://www.notion.so/CVE-2025-44653-24754a1113e780fab128c2c5752f5703CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Uncontrolled Resource Consumption
Uncontrolled Resource Consumption represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.