CVE-2025-30192
BaseFortify
Publication date: 2025-07-21
Last updated on: 2025-07-22
Assigner: Open-Xchange
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| powerdns | recursor | 5.2.2 |
| powerdns | recursor | 5.1.4 |
| powerdns | recursor | 5.2.4 |
| powerdns | recursor | 5.0.10 |
| powerdns | recursor | 5.0.12 |
| powerdns | recursor | 5.1.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-345 | The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-30192 is a vulnerability in PowerDNS Recursor versions up to 5.0.10, 5.1.4, and 5.2.2 that occurs when outgoing EDNS Client Subnet (ECS) queries are enabled. An attacker can spoof answers to ECS-enabled DNS queries with a higher chance of success than non-ECS queries, leading to cache pollution. This means the DNS cache can be poisoned with forged responses, potentially disrupting DNS resolution integrity. The vulnerability does not allow system compromise but can degrade DNS cache reliability. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to perform DNS cache poisoning through spoofed replies to ECS-enabled queries. This can degrade the integrity of your DNS cache, potentially causing denial of service or incorrect DNS responses. Although it does not lead to system compromise or data loss, the disruption in DNS resolution can affect availability and reliability of network services. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading PowerDNS Recursor to patched versions 5.0.12, 5.1.6, or 5.2.4. Alternatively, disable outgoing EDNS Client Subnet (ECS) queries to avoid the vulnerability. Additionally, enabling the configuration setting 'outgoing.edns_subnet_harden' (previously 'edns-subnet-harden') provides the most stringent protection against spoofing attempts. [1]