LiveActive security incident?Get immediate response
CVE Record

CVE-2020-25685: A flaw was found in dnsmasq before version 2.83.

A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This flaw lets an off-path attacker make DNS answers easier to fake against vulnerable dnsmasq resolvers. Successful poisoning could redirect users or systems to attacker-chosen destinations. The primary business risk is integrity of name resolution, not direct code execution.

Executive priority

Treat as a priority DNS integrity issue for infrastructure teams, especially in networks relying on dnsmasq for local resolution. Patch or vendor-validate affected systems, but avoid emergency claims without evidence of active exploitation.

Technical view

dnsmasq before 2.83 matched forwarded query replies using only a weak query-name hash rather than the full query name required by RFC5452. Colliding names reduce the effort needed to forge acceptable replies. Chaining with CVE-2020-25684 further reduces attack complexity.

Likely exposure

Exposure is likely where dnsmasq is used as a forwarding DNS resolver or cache and remains before version 2.83, or where vendor packages identified by distribution advisories were not updated. The source bundle does not enumerate every downstream embedded product.

Exploitation context

The bundle describes off-path DNS cache poisoning potential and notes better odds when chained with CVE-2020-25684. It does not cite CISA KEV listing or confirmed active exploitation, so active exploitation should not be assumed.

Researcher notes

The weakness is reply correlation based on CRC32 without DNSSEC or SHA-1 with DNSSEC, enabling hash collisions across different domains. Assess alongside CVE-2020-25684 because the source states chaining lowers successful attack complexity.

Mitigation direction

  • Update dnsmasq to version 2.83 or a vendor-fixed package.
  • Apply relevant Debian, Fedora, Gentoo, Arista, or OS vendor advisories.
  • Check vendor guidance for downstream appliances bundling dnsmasq.
  • Prioritize resolvers exposed to untrusted client networks or recursive forwarding paths.
  • Review related DNSpooq CVEs, especially CVE-2020-25684.

Validation and detection

  • Inventory systems and appliances running dnsmasq.
  • Confirm installed dnsmasq version or vendor package fix status.
  • Identify DNS forwarding or caching roles using dnsmasq.
  • Check whether affected systems accept queries from untrusted networks.
  • Verify remediation against vendor advisory package versions.
Prepared
Confidence
high
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-326: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-25685 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
9Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/adnsmasqdnsmasq 2.83Listed
Weakness

CWE details

CWE-326

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-326 · source CWE mapping

Inadequate Encryption Strength

Inadequate Encryption Strength represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs