Axessh 4.2 contains a flaw in the logging configuration that only local users can exploit. By entering an excessively long string—500 characters or more—into the log file name field when session logging is enabled, the application crashes during the establishment of a telnet connection, causing a denial of service. This weakness is categorized as CWE‑1282 and provides a local attacker the ability to interrupt service availability for the application.

The affected product is Axessh version 4.2 from the vendor Labf. No other versions or vendors are reported as affected. If an organization is running this specific version of Axessh, it is within the scope of the vulnerability.

The CVSS vector scores the vulnerability as 6.9, indicating medium severity. EPSS information is not available, but the lack of a KEV listing suggests no widespread exploitation has been observed. The attack requires local access to the system where Axessh is installed, limiting the threat to insiders or users with sufficient local privileges. Nevertheless, the impact—immediate application crash—can disrupt business operations until the service is restarted.