CVE-2025-40778

HIGH

Cache poisoning attacks with unsolicited RRs

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-40778 has a selected CVSS score of 8.6 (high); EIP currently links 3 repository PoCs.

Description

Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
3

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 7, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

BIND 9

Browse ISC / BIND 9

Default status: unaffected

CVE List9.11.0 to ≤ 9.16.50affected
9.18.0 to ≤ 9.18.39affected
9.20.0 to ≤ 9.20.13affected
9.21.0 to ≤ 9.21.12affected
9.11.3-S1 to ≤ 9.16.50-S1affected
9.18.11-S1 to ≤ 9.18.39-S1affected
9.20.9-S1 to ≤ 9.20.13-S1affected

Proofs of concept

3

Repository PoCs

GitHubnehkark/CVE-2025-40778Repository PoCby nehkark4Writeup6 files

41.1 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a technical writeup describing CVE-2025-40778, a DNS cache poisoning vulnerability in BIND 9. It includes a detailed vulnerability description, attack scenarios, mitigation strategies, and references. The repository's README and other text files reference exploit scripts (auth_poison.py, validate_poc_forwarder.py) and show their output, but the actual executable code for these scripts is not included in the supplied evidence packets.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of documentation and configuration files describing a proof-of-concept for CVE-2025-40778, a DNS cache poisoning vulnerability. The text files (CVE-2025-40778.md, README.md, readme.txt, requirements.txt) contain educational explanations, setup instructions, and example command-line invocations for the PoC scripts. No executable code, obfuscated payloads, or concealed backdoor behavior is present in the reviewed text. The PoC scripts themselves (auth_poison.py, validate_poc_forwarder.py) are not included in the text evidence, so their behavior cannot be assessed, but the documentation describes only expected DNS manipulation consistent with the claimed vulnerability. No findings of deceptive or harmful behavior were identified.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
LanguagesMarkdownPlaintext
Target softwareBIND 9
Attack typesDNS cache poisoning
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The supplied evidence consists entirely of documentation files (CVE-2025-40778.md, README.md, readme.txt, requirements.txt). These files describe the vulnerability, attack scenarios, and mitigation, and reference exploit scripts (auth_poison.py, validate_poc_forwarder.py) but do not contain the source code for those scripts. The content is a substantive technical analysis without executable exploit or scanner code, which matches the definition of a writeup.

CVE-2025-40778.md:1-476README.md:1-265readme.txt:50-55

Requirements

  • A compromised or malicious authoritative nameserver that can inject out-of-zone records into DNS responses.CVE-2025-40778.md:21
  • A vulnerable recursive DNS resolver (BIND 9) that lacks proper bailiwick checking and caches the injected records.CVE-2025-40778.md:31

Observed behavior

  • The writeup describes how a malicious authoritative nameserver can inject unrelated DNS records into a response, which a vulnerable recursive resolver will cache, poisoning its cache for future queries.CVE-2025-40778.md:21CVE-2025-40778.md:31
  • The README shows console output from running the PoC scripts, including a malicious server log indicating a poisoned record was sent and a dig query showing the legitimate answer.README.md:163-167README.md:192-193
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Contact Information
krakhen@gmail.com, ICQ: 24298753, https://vciso.cloudAuthor contact details provided in documentation; not indicative of backdoor behavior.CVE-2025-40778.md:431-433README.md:38-40
Missing Executable Code
auth_poison.py, validate_poc_forwarder.pyThe PoC scripts are referenced but their source code is not included in the reviewed text evidence; their behavior cannot be verified.readme.txt:51-52CVE-2025-40778.md:380-381
Review boundaries

What the analysis did not establish

  • The evidence packets do not include the content of the auth_poison.py and validate_poc_forwarder.py scripts, which are referenced as the main PoC exploit and validation tool. Only their output and descriptions are present.
  • The packet metadata indicates 2 files were omitted from the text content, which likely correspond to the missing Python scripts.
  • The actual PoC scripts (auth_poison.py, validate_poc_forwarder.py) are not included in the text evidence; their source code was not reviewed. The verdict applies only to the supplied documentation files.
  • Two files (metadata only) were omitted from the text evidence and not analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubsirbuvladste/BIND-9-Cache-Poisoning-PoC---CVE-2025-40778Repository PoCby sirbuvladste0Exploit3 files

13.3 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a proof-of-concept exploit for CVE-2025-40778, a BIND 9 cache poisoning vulnerability. It includes a Python script (attacker.py) that acts as a malicious authoritative DNS server, injecting unsolicited A records into the ADDITIONAL section of a DNS response to poison the resolver's cache. A README provides step-by-step instructions to set up the vulnerable BIND server, attacker, and victim, and demonstrates the successful redirection of a victim's query to an attacker-controlled IP.

Backdoor review

No backdoor observed in reviewed code

The repository contains a proof-of-concept for CVE-2025-40778 (BIND 9 cache poisoning). The README describes the attack conceptually and provides setup instructions. The attacker.py script implements a malicious DNS server that injects an unsolicited A record for www.hacker.com into the ADDITIONAL section of a response for www.poc.lab, which is the exact behavior needed to demonstrate the vulnerability. The server.py script is a harmless Flask web page with a visual animation. No backdoor, concealed payload, or unrelated harmful behavior was observed in any of the three files.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPythonMarkdown
Target softwareBIND 9
Attack typesDNS cache poisoning
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains executable code (attacker.py) that actively injects unsolicited DNS records to poison a resolver's cache, which is the core mechanism of the CVE-2025-40778 vulnerability. The README provides a complete setup and demonstration of the attack, confirming its purpose as an exploit.

attacker.py:19-21README.md:5README.md:225-227

Requirements

  • A vulnerable BIND 9 resolver must be configured to forward queries for a domain controlled by the attacker.README.md:138-145
  • The attacker must run the attacker.py script on a machine reachable by the BIND resolver.README.md:220-222

Observed behavior

  • The attacker.py script listens on UDP port 53 and, upon receiving a query for 'www.poc.lab.', responds with a legitimate answer for that domain and an unsolicited A record for 'www.hacker.com.' in the ADDITIONAL section, pointing to the attacker's IP.attacker.py:19-21
  • The README demonstrates that after the attack, a victim querying the BIND resolver for 'www.hacker.com' receives the attacker's IP address (192.168.174.130) instead of the legitimate one.README.md:233-237
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

DNS POISONING POC
attacker.py injects unsolicited A record for www.hacker.com into ADDITIONAL section of response for www.poc.labThis is the core exploit behavior for CVE-2025-40778 and is consistent with the stated purpose of the PoC.attacker.py:20-21
HARMLESS WEB PAGE
server.py serves a static HTML page with a canvas animation and no malicious logicThe server is used to demonstrate redirection after cache poisoning and contains no backdoor or harmful code.server.py:1-109
Review boundaries

What the analysis did not establish

  • The evidence does not include the actual execution or verification of the exploit; classification is based solely on static analysis of the provided source code and documentation.
  • The server.py file is a Flask web server for demonstrating redirection and is not part of the core exploit mechanism.
  • No binary files were present in the artifact; review is limited to the three provided text files.
  • The review does not assess the safety of executing the PoC in a live environment, only whether the code itself contains backdoor behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubnicholasC03/DNS-Poisoning-Triage-LabRepository PoCby nicholasC031Writeup14 files

75.7 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The repository is an educational lab writeup for DNS and ARP traffic triage. It provides instructions for inspecting a packet capture, configuring Unbound with DNS-over-TLS, and comparing resolver outputs. It explicitly states that the evidence does not prove a live attack or attribute the traffic to CVE-2025-40778, and it contains no exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The reviewed text files (README.md and CVE_RESEARCH.md) are educational documentation for a DNS/ARP triage lab. They describe packet analysis, resolver hardening, and limitations of the evidence. No backdoor, deceptive payload, or concealed executable behavior is present in the supplied text. A binary pcap file is flagged as uninspected, but the text itself contains no instructions to execute it or any other harmful action.

ClassificationWriteup
Model confidence95%
AuthenticationUnknown
LanguagesMarkdownShell
Target softwareBIND 9Unbound
Attack typesDNS cache poisoningARP spoofing
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a writeup because it provides substantive technical analysis and educational instructions for traffic triage and resolver hardening. It contains no exploit or scanner code; the shell commands are for traffic inspection and configuration validation. The repository explicitly disclaims that it proves an attack or exploits a specific CVE.

README.md:1-5CVE_RESEARCH.md:1-32

Requirements

  • The writeup discusses DNS cache poisoning and ARP spoofing as educational topics, but does not provide code to exploit them. It notes that proving an attack would require additional evidence such as device inventories and resolver version information.README.md:5README.md:120

Observed behavior

  • The README provides instructions for inspecting a packet capture using tshark and Wireshark, comparing resolver outputs with a script, and configuring Unbound to forward DNS queries over TLS.README.md:22-25README.md:50-112
  • The CVE_RESEARCH.md file explains why the available evidence is insufficient to attribute the traffic to CVE-2025-40778, noting that the repository does not identify an affected BIND 9 resolver or its version.CVE_RESEARCH.md:17
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Binary File Uninspected
evidence/incident_triage_snippet.pcapA packet capture file is present but was not analyzed; its contents are unknown. The text documentation treats it as a benign educational sample.README.md:42
Review boundaries

What the analysis did not establish

  • The evidence packet includes a binary pcap file that was not analyzed; its content is only described by the repository's own documentation. The analysis is based solely on the provided text files.
  • One binary file (evidence/incident_triage_snippet.pcap) was flagged as uninspected; its contents were not analyzed and could theoretically contain malicious payloads, though the accompanying text does not instruct execution.
  • Only two of fourteen repository files were provided as text; the remaining twelve files (including scripts, configs, and logs) were omitted and not reviewed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

4