CVE-2023-49203
Technitium Dnsserver 11.5.3
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2023-49203 is a high-severity Network Amplification (CWE-406) vulnerability in Technitium Dnsserver. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Denial of Service (T1498); ranked at the 48th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-5 (Denial-of-service Protection) and SI-4 (System Monitoring) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-53207
Vulnerability Data
Technitium 11.5.3 allows remote attackers to cause a denial of service (bandwidth amplification) because the DNSBomb manipulation causes accumulation of low-rate DNS queries such that there is a large-sized response in a burst of traffic.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Denial-of-service protection directly requires mechanisms to limit excessive outbound traffic volume that amplification attacks exploit.
System monitoring detects anomalous traffic volumes indicative of amplification after the weakness is present.
Boundary protection at managed interfaces enforces controls on communications volume and flow that can stop amplification.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Monitoring activities can detect anomalous traffic volumes, yet detection alone does not enforce control.
Logging provides visibility into high-volume traffic but does not itself limit or control it.
Network security controls include traffic filtering and rate-limiting that prevent amplification attacks.
Security of network services can impose volume controls on specific services, but does not address the weakness broadly.
Capacity management directly limits excessive outbound traffic that an actor could otherwise trigger.