Summary
A vulnerability in the REST API of the JUMO device allows an attacker to trigger a denial‑of‑service (DoS) condition. Due to an incorrect implementation of the arrayLimit option in the Node.js qs module, limits for incoming request parameters are not properly enforced. As a result, an attacker can send specially crafted requests containing excessively large or deeply nested arrays, causing the web server to become unresponsive. This condition leads to a crash of the web server, followed by an automatic restart of the device.
Details
Impact
Web server crash and automatic device restart leads to temporary denial of service of all device functionality.
Remediation
Update the affected products to version 431.10.0.0.26 for variTRON 300, to version 388.10.0.0.26 for variTRON 500 and to version 446.10.0.0.26 for variTRON 500 touch. The release of this versions are expected to Q2 2026.
Mitigation
Limit access to the devices webserver (e.g. using a Firewall or apply rate limiting and DoS protection mechanisms at the API gateway).
Vulnerabilities 1
-
Low 3.7
arrayLimit bypass in bracket notation allows DoS via memory exhaustion
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consist…
Revision history
-
#1.0.0
Release version.
References
-
Jumo PSIRT
https://www.jumo.group/de/en/services/product-security
-
CERT@VDE Security Advisories for Jumo
https://certvde.com/de/advisories/vendor/jumo/
-
VDE-2026-009: JUMO: Multiple products affected by nodejs vulnerability - HTML
https://certvde.com/en/advisories/VDE-2026-009