Description
totd 1.5.3 uses a fixed UDP source port in upstream queries sent to DNS resolvers. This allows DNS cache poisoning because there is not enough entropy to prevent traffic injection attacks.
References (4)
Scores
CVSS v3
9.8
EPSS
0.0078
EPSS Percentile
73.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-331
Status
published
Products (1)
totd_project/totd
1.5.3
Published
Aug 15, 2022
Tracked Since
Feb 18, 2026