> The core issue is that `EndpointSessionMapEntry` imposes no limit on the number of sessions. Consequently, an attacker can forge fake client IP addresses an

> The core issue is that `EndpointSessionMapEntry` imposes no limit on the number of sessions. Consequently, an attacker can forge fake client IP addresses and port numbers , repeatedly creating new sessions until system resources are exhausted. Aren't you just able to flood any DHCP server instead? PXE deployment already hinges on DHCP provision > PXE broadcast > download image > launch, you might as well just exhaust the DHCP server's pool by using all ephemeral addresses or spoofing MAC addresses endlessly. Additionally, WDS is active only in-LAN and usually only on areas like employee office networks (i.e.: not listening on the servers' subnet, for example, unlike AD services). You'd need lateral movement to an "office LAN" to reach said WDS server.