The vulnerability is a memory leak in the scan method of Softing smartLink HW-PN firmware. After the method completes, allocated memory is never released, causing continual consumption of heap space. Over time this can exhaust available memory, degrade performance, and ultimately result in crashes, providing a denial-of-service condition. This weakness is identified as CWE-401.

Softing smartLink HW-PN firmware versions from 1.04 through the last release before 1.10 are affected. Version 1.10 and later are not impacted by this issue.

The CVSS score of 6.3 indicates moderate severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog, so exploit probability is not quantified. The likely attack vector requires repeated use of the scan function; this is inferred from the description, as the vulnerability is a memory leak that accrues over repeated calls. In practice, repeated calls could be triggered by a local user with device access or a remote operator if the device is network-exposed. The resulting resource exhaustion leads to operational disruption rather than compromise of confidentiality or integrity.