A denial of service vulnerability in Frigate 2.02 allows unauthenticated attackers to crash the application by submitting a specifically crafted oversized string to the command line interface.

This vulnerability is a resource allocation flaw (CWE-770) where the application fails to limit input length in its command line interface. An attacker can trigger a crash by pasting a string of 8000 repeated characters into the field, which results in a denial of service condition.

Successful exploitation results in the immediate termination of the Frigate application, causing a denial of service. While this vulnerability does not allow for remote code execution, it disrupts business operations by rendering the software unusable, requiring a manual restart of the service to restore functionality. The CVSS score of 7.5 reflects the high availability impact despite the requirement for local or user interaction.

Immediate Action: There is no official patch available from the vendor. Users should restrict access to the application and avoid pasting untrusted or unverified text into the command line interface.

Proactive Monitoring: Monitor system logs for unexpected application crashes or service terminations that correlate with user activity in the command line interface.

Compensating Controls: Implement endpoint security solutions that monitor for abnormal process behavior or memory corruption attempts to detect exploitation patterns.

Public Exploit Available: Yes, a proof of concept exists and is documented on Exploit-DB (EDB-ID: 48613).

Given the lack of a vendor-supplied patch, organizations relying on Frigate 2.02 must prioritize the implementation of administrative controls to prevent unauthorized interaction with the vulnerable interface. Users should be cautioned against inputting arbitrary data into the command line field, and security teams should evaluate the necessity of the software in their environment until a formal fix or replacement is available.