CVE-2023-7250
Redhat Enterprise Linux 8.0 … 9.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-7250 is a medium-severity Permissive List of Allowed Inputs (CWE-183) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked in the top 40% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-59431
Vulnerability Data
A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expected amount of data to the iperf server, which can cause the server…
more
to hang indefinitely waiting for the remainder or until the connection gets closed. This will prevent other connections to the server, leading to a denial of service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.5.2V4.4.2
Mitigating Controls (NIST 800-53 r5) AI
Strict validity checks on inputs directly stop overly permissive allow lists from being used as the protection mechanism.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require rigorous allow-list design and testing that prevents permissive input validation.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Application security requirements can mandate strict, minimal allow-lists and input validation rules that prevent overly permissive lists.
A.8.27 mandates security-by-design principles (least privilege, default-deny, distrust-external-input, secure session control, data validation/sanitization, assume-breach) that reach many but not all permissive-allowlist cases; a bounded remainder (e.g. custom business-logic allowlists whose enumerated safe values are chosen incorrectly) can still be introduced and exploited.
Secure coding standards enforce rigorous input validation and reject unsafe values, mitigating permissive allow-list weaknesses.
Security testing can detect overly broad allow-lists, but does not inherently prevent their creation.