JUMO: Multiple products affected by nodejs vulnerability
A vulnerability in the REST API of the JUMO device allows an attacker to trigger a denial‑of‑service (DoS) condition. Due to an incorrect implementation of the arrayLimit option in the Node.js qs module, limits for incoming request parameters are not properly enforced. As a result, an attacker can send specially crafted requests containing excessively large or deeply nested arrays, causing the web server to become unresponsive. This condition leads to a crash of the web server, followed by an automatic restart of the device.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-15284US | — | — | ||
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
Summary
The arrayLimit option in qs did not enforce limits for bra… | ||||
references
External citations — patches, advisories, analysis.
remediations (2)
- Mitigation
Limit access to the devices webserver (e.g. using a Firewall or apply rate limiting and DoS protection mechanisms at the API gateway).
- Fixed
Update the affected products to version 431.10.0.0.26 for variTRON 300, to version 388.10.0.0.26 for variTRON 500 and to version 446.10.0.0.26 for variTRON 500 touch. The release of this versions are expected to Q2 2026.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan