CVE-2025-71058: Dual DHCP DNS Server RCE Vulnerability

CVE-2025-71058 Overview

Dual DHCP DNS Server 8.01 contains a critical DNS cache poisoning vulnerability due to improper validation of UDP DNS responses. The implementation accepts and caches DNS responses without verifying that they originate from a legitimate configured upstream DNS server, relying primarily on Transaction ID (TXID) matching. This allows a remote attacker to inject forged DNS responses and poison the cache, potentially redirecting victims to attacker-controlled destinations.

Critical Impact

Remote attackers can poison the DNS cache without authentication, enabling widespread traffic redirection to malicious destinations for all clients relying on the affected DNS server.

Affected Products

• Dual DHCP DNS Server 8.01
• Earlier versions of Dual DHCP DNS Server may also be affected

Discovery Timeline

• 2026-04-07 - CVE-2025-71058 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2025-71058

Vulnerability Analysis

This DNS cache poisoning vulnerability stems from inadequate source validation in the DNS response handling mechanism of Dual DHCP DNS Server. When the server receives a UDP DNS response, it matches the response primarily based on the Transaction ID (TXID) without properly verifying that the response originated from the configured upstream DNS server. This design flaw allows attackers to craft and send forged DNS responses that will be accepted and cached by the server.

The vulnerability is classified under CWE-94 (Improper Control of Generation of Code), though it more precisely represents a DNS protocol implementation flaw. An attacker can exploit this by sending specially crafted UDP packets containing forged DNS responses with guessed or observed TXIDs. Once a malicious response is cached, all subsequent DNS queries for the poisoned domain will return the attacker-controlled IP address, enabling various attack scenarios including phishing, malware distribution, and man-in-the-middle attacks.

Root Cause

The root cause lies in the insufficient validation logic when processing incoming DNS responses. The server implementation fails to verify the source IP address and port of DNS responses against the configured upstream DNS servers. Instead, it relies solely on TXID matching, which is vulnerable to spoofing attacks, especially when TXIDs are predictable or can be brute-forced within the query timeout window.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker positioned on the network path (or capable of sending spoofed UDP packets) can flood the target DNS server with forged responses containing malicious IP address mappings. The attack succeeds when a forged response with a matching TXID arrives before the legitimate response from the actual upstream DNS server. The attacker can target high-value domains to maximize impact, poisoning entries that redirect victims to credential harvesting sites or malware distribution infrastructure.

Detection Methods for CVE-2025-71058

Indicators of Compromise

• Unexpected DNS responses from IP addresses not matching configured upstream DNS servers
• Sudden changes in cached DNS records pointing to unfamiliar or suspicious IP addresses
• DNS query logs showing responses with mismatched source addresses
• Increased volume of DNS traffic from unknown sources targeting the DNS server port

Detection Strategies

• Monitor DNS server logs for responses originating from non-configured upstream servers
• Implement network-level anomaly detection for unexpected DNS traffic patterns
• Deploy intrusion detection rules to identify DNS response flooding attempts
• Regularly audit DNS cache contents for unexpected or suspicious entries

Monitoring Recommendations

• Enable verbose logging on the DNS server to capture source IP addresses of all responses
• Implement network flow analysis to detect DNS response spoofing attempts
• Set up alerts for cache modifications involving critical domain names
• Deploy DNSSEC validation where possible to detect forged responses

How to Mitigate CVE-2025-71058

Immediate Actions Required

• Consider replacing Dual DHCP DNS Server 8.01 with alternative DNS server software that properly validates response sources
• Implement network-level filtering to allow DNS responses only from configured upstream servers
• Deploy DNSSEC to cryptographically validate DNS responses where supported
• Monitor DNS cache entries for signs of poisoning

Patch Information

No vendor patch information is currently available. Refer to the GitHub Security Advisory for CVE-2025-71058 and the SourceForge project page for updates on remediation options.

Workarounds

• Configure firewall rules to drop DNS responses from IP addresses other than configured upstream DNS servers
• Implement source IP and port validation at the network perimeter
• Consider migrating to DNS server software with proper response validation (e.g., BIND, Unbound, or PowerDNS)
• Reduce DNS cache TTL values to limit the duration of potential cache poisoning

# Example firewall rule to restrict DNS responses (iptables)
# Replace UPSTREAM_DNS_IP with your configured upstream DNS server address
iptables -A INPUT -p udp --sport 53 ! -s UPSTREAM_DNS_IP -j DROP
iptables -A INPUT -p udp --sport 53 -s UPSTREAM_DNS_IP -j ACCEPT