CVE-2025-71058

CriticalCVSS 9.1/10Last modified Jul 24, 2026

Description

Dual DHCP DNS Server 8.01 improperly accepts and caches UDP DNS responses without validating that the response originates from a legitimate configured upstream DNS server. The implementation matches responses primarily by TXID and inserts results into the cache, enabling a remote attacker to inject forged responses and poison the DNS cache, potentially redirecting victims to attacker-controlled destinations.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Apr 7, 2026
Last modified
Jul 24, 2026
NVD status
Awaiting Analysis

Related CVEs from 2025

CVE-2025-71065.3danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. The `checkAccess` functionCVE-2025-710637.5Errands before 46.2.10 does not verify TLS certificates for CalDAV servers.CVE-2025-71064In the Linux kernel, the following vulnerability has been resolved: net: hns3: using the num_tqps in the vf driver to apply for resources CVE-2025-71065In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential deadlock As Jiaming Zhang and syzbot repoCVE-2025-710667.8In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove class from active list before deleting inCVE-2025-71067In the Linux kernel, the following vulnerability has been resolved: ntfs: set dummy blocksize to read boot_block when mounting When mountiCVE-2025-710687.8In the Linux kernel, the following vulnerability has been resolved: svcrdma: bound check rq_pages index in inline path svc_rdma_copy_inlinCVE-2025-71069In the Linux kernel, the following vulnerability has been resolved: f2fs: invalidate dentry cache on failed whiteout creation F2FS can mouCVE-2025-71077.5A vulnerability classified as critical has been found in SimStudioAI sim up to 0.1.17. Affected is the function handleLocalFile of the file CVE-2025-710707.8In the Linux kernel, the following vulnerability has been resolved: ublk: clean up user copy references on ublk server exit If a ublk servCVE-2025-710717.8In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: fix use-after-free on probe deferral The driver is droCVE-2025-710725.5In the Linux kernel, the following vulnerability has been resolved: shmem: fix recovery on rename failures maple_tree insertions can fail
CVE-2025-71058: Critical severity, CVSS 9.1 | Vulnix