VulnerabilityAnalyzed
CVE-2023-28456
It enables attackers to launch amplification attacks (3 times more than other "golden model" software like BIND) and cause potential DoS.
HIGH 7.5EPSS 0.54%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.54%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An issue was discovered in Technitium through 11.0.2. It enables attackers to launch amplification attacks (3 times more than other "golden model" software like BIND) and cause potential DoS.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.54% probability · 44th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-406
- Affected
- technitium/dnsserver
- Source
- cve@mitre.org
References
- https://gist.github.com/idealeer/89947ca07836fd0f7e9761198ca9a0f3Third Party Advisory
- https://technitium.com/dns/Product
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.