Dual DHCP DNS Server 8.01 fails to validate the source of UDP DNS responses before caching them, relying primarily on the TXID for matching. This allows remote attackers to inject forged DNS responses into the cache, resulting in DNS cache poisoning and potential redirection of victims to malicious sites. The vulnerability is identified as CVE-2025-71058 and was published in April 2026. There is no CVSS score or vendor advisory available, and no patch or mitigation details have been provided.

The vulnerability enables remote attackers to poison the DNS cache of the affected server by injecting forged UDP DNS responses. This can lead to users being redirected to attacker-controlled destinations, potentially facilitating phishing, malware distribution, or other malicious activities. No known exploits in the wild have been reported, and the extent of impact depends on the deployment of the affected software.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing network-level protections such as DNS response validation or filtering, and monitor for suspicious DNS activity related to the affected server. Avoid relying solely on TXID for DNS response validation.