The vulnerability is a buffer overflow in the username field of the Security options, allowing an attacker who has local access to supply a string that exceeds the expected buffer size. This overflow causes the NetworkActiv Web Server 4.0 application to crash, resulting in a denial of service. The weakness is a classic stack-based buffer overflow (CWE-787), which compromises the server’s availability but does not expose data or allow remote code execution.

NetworkActiv Web Server version 4.0 is affected. The product is offered by NetworkActiv. No other versions or variants are specified in the CNA data.

The CVSS score of 6.9 indicates medium severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local attacker privileges and access to the Set username interface, meaning the risk is limited to environments where an attacker can log into the server. If the server is exposed to untrusted users, the risk profile could effectively increase.