CVE-2025-71058: n/a
Dual DHCP DNS Server 8.01 improperly accepts and caches UDP DNS responses without validating that the response originates from a legitimate configured upstream DNS server. The implementation matches responses primarily by TXID and inserts results into the cache, enabling a remote attacker to inject forged responses and poison the DNS cache, potentially redirecting victims to attacker-controlled destinations.
AI Analysis
Technical Summary
Dual DHCP DNS Server 8.01 fails to validate the source of UDP DNS responses before caching them, relying mainly on transaction ID (TXID) matching. This weakness enables remote attackers to perform DNS cache poisoning by injecting forged responses, which can redirect victims to attacker-controlled sites. The vulnerability is tracked as CVE-2025-71058 with a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). There is no vendor advisory or patch information available at this time.
Potential Impact
The vulnerability allows remote attackers to poison the DNS cache of affected servers, potentially redirecting users to malicious destinations. This compromises the integrity and availability of DNS responses but does not directly impact confidentiality. Exploitation could lead to widespread redirection attacks affecting users relying on the vulnerable DNS server.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing network-level protections such as filtering unexpected DNS responses or deploying DNSSEC where possible to mitigate cache poisoning risks.
CVE-2025-71058: n/a
Description
Dual DHCP DNS Server 8.01 improperly accepts and caches UDP DNS responses without validating that the response originates from a legitimate configured upstream DNS server. The implementation matches responses primarily by TXID and inserts results into the cache, enabling a remote attacker to inject forged responses and poison the DNS cache, potentially redirecting victims to attacker-controlled destinations.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Dual DHCP DNS Server 8.01 fails to validate the source of UDP DNS responses before caching them, relying mainly on transaction ID (TXID) matching. This weakness enables remote attackers to perform DNS cache poisoning by injecting forged responses, which can redirect victims to attacker-controlled sites. The vulnerability is tracked as CVE-2025-71058 with a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). There is no vendor advisory or patch information available at this time.
Potential Impact
The vulnerability allows remote attackers to poison the DNS cache of affected servers, potentially redirecting users to malicious destinations. This compromises the integrity and availability of DNS responses but does not directly impact confidentiality. Exploitation could lead to widespread redirection attacks affecting users relying on the vulnerable DNS server.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing network-level protections such as filtering unexpected DNS responses or deploying DNSSEC where possible to mitigate cache poisoning risks.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-01-09T00:00:00.000Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d5874b43e2781bad84eb0b
Added to database: 4/7/2026, 10:38:03 PM
Last enriched: 5/15/2026, 9:23:41 AM
Last updated: 5/23/2026, 8:06:17 PM
Views: 65
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.