CVE-2010-2156

ISC DHCP 4.0-4.0.2 and 4.1-4.1.1 - Denial of Service via Zero-Length Client ID

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2010-2156. PoCs published by sid, sid, theLightCosine, including Metasploit module auxiliary/dos/dhcp/isc_dhcpd_clientid.

AI-analyzed exploit summary This exploit sends a malformed DHCP request packet to trigger a denial-of-service (DoS) condition in vulnerable versions of isc-dhcpd. It uses Scapy to craft a packet with an invalid client identifier, causing the server to crash.

Description

ISC DHCP 4.1 before 4.1.1-P1 and 4.0 before 4.0.2-P1 allows remote attackers to cause a denial of service (server exit) via a zero-length client ID.

Exploits (2)

exploitdb WORKING POC

by sid · pythondosmultiple

https://www.exploit-db.com/exploits/14185

View Code ZIP pw:eip

This exploit sends a malformed DHCP request packet to trigger a denial-of-service (DoS) condition in vulnerable versions of isc-dhcpd. It uses Scapy to craft a packet with an invalid client identifier, causing the server to crash.

Classification

Working Poc 90%

Attack Type

Dos

Complexity

Trivial

Reliability

Reliable

Target: isc-dhcpd 4.0.x, 4.1.x, 4.2.x

No auth needed

Prerequisites: Network access to the DHCP server · Valid IP address within the target subnet

MITRE ATT&CK

T1499 - Endpoint Denial of Service

devstral-2 · analyzed Feb 16, 2026 Full analysis →

metasploit WORKING POC

by sid, theLightCosine · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/dhcp/isc_dhcpd_clientid.rb

View Code ZIP pw:eip

This Metasploit module exploits CVE-2010-2156 by sending a malformed DHCP request with a zero-length client_id option, causing the ISC DHCP server to crash due to an abnormal exit during hashing.