CVE-2025-71058

Dual DHCP DNS Server version 8.01 contains a critical DNS cache poisoning vulnerability that allows remote attackers to inject forged DNS responses due to insufficient validation of upstream DNS server origin. The flaw exists because the application matches responses primarily by transaction ID (TXID) without verifying that responses originate from legitimate configured upstream servers, enabling attackers to redirect victims to malicious destinations. The vulnerability carries a CVSS 3.1 score of 9.1 (CRITICAL) with a network-based attack vector requiring no privileges or user interaction, indicating high exploitability. The attack has high integrity and availability impacts, as successful exploitation enables DNS cache poisoning and potential service disruption, though confidentiality is not directly affected. There is currently no evidence of active exploitation in the wild, and the vulnerability does not appear on the CISA Known Exploited Vulnerabilities catalog. While the EPSS score of 0.00144 indicates lower probability of exploitation relative to other CVEs, organizations running Dual DHCP DNS Server 8.01 should prioritize patching given the critical severity rating and straightforward attack requirements.