Dhcpd
Vendor:
First CVE: Jul 26, 2002 · Active for 23 years
9
Total CVEs
More Total CVEs than 86% of tracked products
1.3
Avg CVEs / Year
Higher CVE frequency than 55% of tracked products
8.0
Avg CVSS
Higher Avg CVSS than 70% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Dhcpd over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jul 26, 2002
23 years ago
Most Recent CVE
May 26, 2021
1,886 days ago
CVE Severity & Scoring
Dhcpd9 CVEs
22%
78%
All CVEs352,427 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local0 (0.0%)
Network1 (11.1%)
Unknown7 (77.8%)
Physical0 (0.0%)
Adjacent Network1 (11.1%)
Attack Complexity
Low2 (22.2%)
High0 (0.0%)
Unknown7 (77.8%)
User Interaction
None2 (22.2%)
Unknown7 (77.8%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None2 (22.2%)
Unknown7 (77.8%)
Top CVEs
Signals from CVEs in this product scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2002-0702HIGH Format string vulnerabilities in the logging routines for dynamic DNS code (print.c) of ISC DHCP daemon (DHCPD) 3 to 3.0.1rc8, with the NSUPDATE option enabled, allow remote malici | Jul 26, 2002 | 10.0 | 52 | NO | YES |
CVE-2004-0460HIGH Buffer overflow in the logging capability for the DHCP daemon (DHCPD) for ISC DHCP 3.0.1rc12 and 3.0.1rc13 allows remote attackers to cause a denial of service (server crash) and p | Aug 6, 2004 | 10.0 | 48 | NO | NO |
CVE-2004-0461HIGH The DHCP daemon (DHCPD) for ISC DHCP 3.0.1rc12 and 3.0.1rc13, when compiled in environments that do not provide the vsnprintf function, uses C include files that define vsnprintf t | Aug 6, 2004 | 10.0 | 38 | NO | NO |
CVE-2019-6470HIGH There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd relating to the use of th | Nov 1, 2019 | 7.5 | 28 | NO | NO |
CVE-2004-1006HIGH Format string vulnerability in the log functions in dhcpd for dhcp 2.x allows remote DNS servers to execute arbitrary code via certain DNS messages, a different vulnerability than | Mar 1, 2005 | 10.0 | 28 | NO | NO |
CVE-2021-25217HIGH In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond | May 26, 2021 | 7.4 | 27 | NO | NO |
CVE-2003-0026HIGH Multiple stack-based buffer overflows in the error handling routines of the minires library, as used in the NSUPDATE capability for ISC DHCPD 3.0 through 3.0.1RC10, allow remote at | Jan 17, 2003 | 7.5 | 27 | NO | NO |
CVE-2003-0039MEDIUM ISC dhcrelay (dhcp-relay) 3.0rc9 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (packet storm) via a certain BOOTP packet that is fo | Feb 7, 2003 | 5.0 | 22 | NO | NO |
CVE-2006-3122MEDIUM The supersede_lease function in memory.c in ISC DHCP (dhcpd) server 2.0pl5 allows remote attackers to cause a denial of service (application crash) via a DHCPDISCOVER packet with a | Aug 9, 2006 | 5.0 | 16 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (9 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
11.1% of CVEs· 89th percentile
Social Chatter
Signals from CVEs in this product scope (9 CVEs).
Media Mentions
Signals from CVEs in this product scope (9 CVEs).
Top CNAs Publishing CVEs For Dhcpd
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 3.0_pl2 | 1 | 10.0 | 8.0% | 0 | 0 |
| 3.0_pl1 | 1 | 10.0 | 8.0% | 0 | 0 |
| 3.0_b2pl9 | 1 | 10.0 | 8.0% | 0 | 0 |
| 3.0_b2pl23 | 1 | 10.0 | 8.0% | 0 | 0 |
| 3.0.1 | 6 | 8.4 | 16.3% | 0 | 1 |
| 3.0 | 3 | 9.5 | 14.8% | 0 | 1 |
| 2.0.pl5 | 1 | 10.0 | 8.0% | 0 | 0 |