CVE-2025-40775

HIGH

BIND <9.20.8-9.21.7 - Info Disclosure

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-40775. PoCs published by AlexSvobo.

AI-analyzed exploit summary This repository demonstrates a multi-stage attack exploiting CVE-2025-40775 (BIND DoS via malformed TSIG records) to disrupt DNS resolution, force NHI secret rotation failures, and bypass zero-trust policies using static credentials. The PoC includes scripts to crash BIND, simulate NHI rotation failures, and bypass API authentication.

Description

When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7.

Exploits (1)

nomisec WORKING POC 5 stars

by AlexSvobo · poc

https://github.com/AlexSvobo/nhi-zero-trust-bypass

View Code ZIP pw:eip

This repository demonstrates a multi-stage attack exploiting CVE-2025-40775 (BIND DoS via malformed TSIG records) to disrupt DNS resolution, force NHI secret rotation failures, and bypass zero-trust policies using static credentials. The PoC includes scripts to crash BIND, simulate NHI rotation failures, and bypass API authentication.

Classification

Working Poc 95%

Attack Type

Dos | Auth Bypass

Complexity

Moderate

Reliability

Reliable

Target: BIND 9.20.0–9.20.8, 9.21.0–9.21.7

No auth needed

Prerequisites: Network access to target DNS server · BIND version vulnerable to CVE-2025-40775 · NHI system relying on DNS for secret rotation

MITRE ATT&CK

T1499 - Endpoint Denial of Service T1552 - Unsecured Credentials T1110 - Brute Force

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3

Core References

Various Sources vendor-advisory

https://kb.isc.org/docs/cve-2025-40775

Mailing List

http://www.openwall.com/lists/oss-security/2025/05/21/1

Vendor Advisory

https://security.netapp.com/advisory/ntap-20250523-0001/

Scores

CVSS v3 7.5

EPSS 0.1075

EPSS Percentile 95.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-232

Status published

Products (2)

ISC/BIND 9 9.20.0 - 9.20.8

ISC/BIND 9 9.21.0 - 9.21.7

Published May 21, 2025

Tracked Since Feb 18, 2026