LiveActive security incident?Get immediate response
CVE Record

CVE-2020-25684: A flaw was found in dnsmasq before version 2.83.

A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Dnsmasq could accept a forged DNS reply more easily than it should, allowing a nearby or otherwise network-positioned attacker to poison DNS cache entries. That can send users or systems to the wrong destination. The strongest sourced impact is integrity loss, not proven remote code execution.

Executive priority

Treat this as a priority patching issue for DNS infrastructure and appliances. Business risk comes from traffic misdirection and trust failure in name resolution, with higher urgency where dnsmasq serves many clients or untrusted networks.

Technical view

In forward.c:reply_query(), dnsmasq checked whether a reply destination address and port matched any pending forwarded query, but did not use them to retrieve the exact query. This weakened RFC5452-style DNS response matching and reduced spoofing attempts needed for DNS cache poisoning, especially when chained with CVE-2020-25685 or CVE-2020-25686.

Likely exposure

Systems using dnsmasq before version 2.83 as a DNS forwarder or cache are the likely exposure. Embedded, network, Linux, and appliance deployments may be affected if their vendor shipped vulnerable dnsmasq packages.

Exploitation context

The bundle does not show CISA KEV listing or confirmed active exploitation. The described attacker is on the network and can forge DNS replies. Chaining with related dnsmasq flaws can reduce successful attack complexity.

Researcher notes

Evidence supports DNS cache poisoning via insufficient reply-to-query matching. The source bundle has no CVSS vector and no KEV status. Confirm exact affected and fixed builds through distribution or device-vendor advisories because embedded vendors may backport fixes without changing upstream version semantics.

Mitigation direction

  • Inventory dnsmasq deployments, including embedded appliances and network devices.
  • Apply vendor security updates for dnsmasq; verify fixed packages are installed.
  • Upgrade to dnsmasq 2.83 or later where vendor guidance confirms suitability.
  • Review device-vendor advisories, including distribution and appliance notices.
  • Limit DNS forwarding service access to trusted networks where operationally feasible.

Validation and detection

  • Check installed dnsmasq versions and package changelogs against vendor advisories.
  • Confirm vulnerable DNS forwarders are not reachable by untrusted network segments.
  • Review DNS resolver logs for unusual cache answers or unexpected upstream behavior.
  • Track related CVE-2020-25685 and CVE-2020-25686 exposure on the same assets.
Prepared
Confidence
high
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-358: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-25684 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
10Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/adnsmasqdnsmasq 2.83Listed
Weakness

CWE details

CWE-358

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.