CVE-2025-71058

CriticalRCEUpdated

Published: 07 April 2026

Published

07 April 2026

Modified

21 April 2026

KEV Added

—

Patch

—

CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS Score 0.0016 36.0th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-71058 is a critical-severity Code Injection (CWE-94) vulnerability in Sourceforge (inferred from references). Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-21 (Secure Name/Address Resolution Service (Recursive or Caching Resolver)) and SC-22 (Architecture and Provisioning for Name/Address Resolution Service).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver) good match

prevent

SC-21 requires recursive or caching DNS resolvers to validate response authenticity and origin, directly preventing cache poisoning from forged UDP responses lacking source validation.

SC-22 Architecture and Provisioning for Name/Address Resolution Service partial match

prevent

SC-22 mandates architectural provisioning of DNS services with cryptographic mechanisms, supporting validation of upstream responses to mitigate poisoning attacks.

SC-7 Boundary Protection partial match

prevent

SC-7 boundary protection restricts network communications to only legitimate upstream DNS server sources, blocking forged responses from unauthorized origins.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1557 Adversary-in-the-Middle Credential Access

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.

attack.mitre.org →

Why these techniques?

The vulnerability is a DNS cache poisoning issue in a public-facing DNS server exploitable remotely without authentication (T1190), directly enabling adversary-in-the-middle attacks by forging DNS responses to redirect client traffic (T1557).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Dual DHCP DNS Server 8.01 improperly accepts and caches UDP DNS responses without validating that the response originates from a legitimate configured upstream DNS server. The implementation matches responses primarily by TXID and inserts results into the cache, enabling a…

remote attacker to inject forged responses and poison the DNS cache, potentially redirecting victims to attacker-controlled destinations.

Deeper analysisAI

CVE-2025-71058 is a DNS cache poisoning vulnerability in Dual DHCP DNS Server version 8.01. The software improperly accepts and caches UDP DNS responses without validating that they originate from a legitimate configured upstream DNS server. It matches responses primarily by transaction ID (TXID) and inserts them into the cache, which enables the injection of forged responses. The issue is classified under CWE-94 (Improper Control of Generation of Code ('Code Injection')) and carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).

A remote attacker with network access can exploit this vulnerability without privileges or user interaction by sending forged UDP DNS responses that match the TXID of legitimate queries. Successful exploitation poisons the DNS cache, allowing the attacker to redirect victims querying the server to attacker-controlled destinations, compromising traffic integrity and potentially disrupting availability through malicious insertions.

References include a proof-of-concept exploit code at https://github.com/FPokerFace/Security-Advisory/blob/main/CVE-2025-71058/poc.c and further details in the repository at https://github.com/FPokerFace/Security-Advisory/tree/main/CVE-2025-71058. The project page for Dual DHCP DNS Server is hosted at https://sourceforge.net/projects/dhcp-dns-server/. No vendor advisories or patches are specified in the available information.