CVE-2025-40780

HighCVSS 8.6/10Last modified Oct 8, 2026

Description

In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-341

Affected software

VendorProductVersions
ISCBIND 9>= 9.16.0, <= 9.16.50; >= 9.18.0, <= 9.18.39; >= 9.20.0, <= 9.20.13; >= 9.21.0, <= 9.21.12; >= 9.16.8-S1, <= 9.16.50-S1; >= 9.18.11-S1, <= 9.18.39-S1; >= 9.20.9-S1, <= 9.20.13-S1

References

Timeline

Published
Oct 22, 2025
Last modified
Oct 8, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-40799.8A vulnerability, which was classified as critical, was found in PCMan FTP Server up to 2.0.7. Affected is an unknown function of the componeCVE-2025-407959.8A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All vCVE-2025-407967.5A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All vCVE-2025-407977.5A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All vCVE-2025-407987.5A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All vCVE-2025-40808.8A vulnerability has been found in PHPGurukul Online Nurse Hiring System 1.0 and classified as critical. Affected by this vulnerability is anCVE-2025-408007.4A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX V2412 (All versions < CVE-2025-408018.1A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), JT Bi-Directional TranslaCVE-2025-408024.3A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions). The affected device may be susceptible to resourceCVE-2025-408033.1A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions). The affected device exposes certain non-critical iCVE-2025-408049.1A vulnerability has been identified in SIMATIC Virtualization as a Service (SIVaaS) (All versions). The affected application exposes a netwoCVE-2025-4080510.0Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an unauthenticated remote atta
CVE-2025-40780: High severity, CVSS 8.6 | Vulnix