External risk intelligence

Dual DHCP DNS Server DNS Cache Poisoning Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-71058

Dual DHCP DNS Server is typically deployed as an internal network service to manage local address assignment and name resolution. While it processes DNS traffic which can be exposed if improperly configured, it is not designed as a public-facing edge service or internet gateway, making public internet reachability possible but not a common or intended deployment pattern.

Code Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in Dual DHCP DNS Server software that could allow attackers to poison the DNS cache. This could enable them to redirect users to malicious websites, impacting trust and potentially leading to data compromise. The main concern is confirming relevance and exposure.

Forged DNS responses can redirect users.
Affects network trust and redirecting users.
Confirm relevance and exposure for leadership.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending crafted DNS responses over the network to the vulnerable server. Since the server does not properly validate the source of these responses, it will cache the forged information. This DNS cache poisoning can lead to users being redirected to malicious websites instead of their intended destinations.

No authentication or privileges needed.
Unvalidated DNS responses are cached.
Redirect users to malicious sites.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to poison the DNS cache of the Dual DHCP DNS Server. When supported, this could redirect users to malicious websites or services by returning forged DNS responses.

DNS cache entries could be poisoned.
Forged DNS responses may be accepted.
Victims could be redirected to attacker sites.

Operational Fix

Recommended remediation, mitigation, and detection steps

The security team, alongside the application owners responsible for the Dual DHCP DNS Server, should lead the initial response. The first practical step is to identify all instances of this software within the environment, determine their network exposure and business criticality, and confirm the accountable system owners. Subsequently, a remediation plan should be developed based on the identified risks.

Application owners and security teams own this.
Verify software instances and their reachability.
Plan remediation based on risk exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dual DHCP DNS Server?

Dual DHCP DNS Server is a software utility that combines DHCP and DNS services into one package. It is primarily used to manage IP address assignments and translate domain names to IP addresses for devices on a local area network, helping small networks manage connectivity without requiring enterprise-grade infrastructure.

How does this DNS cache poisoning vulnerability work?

This vulnerability involves a weakness known as Improper Control of Generation of Code, or CWE-94. The software fails to verify if incoming DNS responses actually come from a legitimate upstream server. Because it only checks the Transaction ID (TXID), an attacker can inject fake DNS information into the cache, causing the server to map domain names to attacker-controlled IP addresses.

Does simply receiving network traffic trigger this bug?

No. The software must specifically process and cache a forged DNS response sent by an attacker. Legitimate traffic or standard network requests do not trigger the issue; the vulnerability is only activated when the server accepts a malicious, spoofed response that it incorrectly trusts as a valid answer to a previous request.

Why should I be concerned if my server is internal?

Halo Surface Signal notes that while this software is typically meant for internal use, it is not an edge gateway. Even if the server is not directly public-facing, it remains at risk if an attacker manages to reach your internal network. You should prioritize servers that have broader network visibility or handle sensitive traffic.

What should I do first to address this CVE?

Start by identifying every instance of Dual DHCP DNS Server running in your environment. Once you have a complete list, verify the network configuration for each server to understand if they are accessible from untrusted segments. Work with the designated system owners to assess the risk and prepare a plan to update or isolate the software.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.