Use-after-free vulnerability in the webserver of Softing smartLink HW-DP and HW-PN devices can cause the server to crash or become unavailable when multiple implicit reads are performed in parallel. The flaw originates from improper memory handling after an object has been freed (CWE-416), leading to a denial-of-service condition that disrupts the device’s network services.

The flaw affects Softing smartLink HW-DP firmware versions up to and including 1.31, and Softing smartLink HW-PN firmware versions before 1.02. Devices running any of these firmware releases are susceptible to the vulnerability.

The CVSS base score is 6.5, indicating a medium severity level. Exploit probability data (EPSS) is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw remotely by sending crafted HTTP requests to the device over its network interface; no local privilege is required. Because the device may be exposed in industrial control environments, an unpatched unit could experience periods of unusability due to repeated crashes.