{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-40780","assignerOrgId":"404fd4d2-a609-4245-b543-2c944a302a22","state":"PUBLISHED","assignerShortName":"isc","dateReserved":"2025-04-16T08:44:49.857Z","datePublished":"2025-10-22T15:48:27.146Z","dateUpdated":"2025-11-04T21:10:16.728Z"},"containers":{"cna":{"providerMetadata":{"orgId":"404fd4d2-a609-4245-b543-2c944a302a22","shortName":"isc","dateUpdated":"2025-10-22T15:48:27.146Z"},"title":"Cache poisoning due to weak PRNG","datePublic":"2025-10-22T00:00:00.000Z","affected":[{"vendor":"ISC","product":"BIND 9","versions":[{"version":"9.16.0","lessThanOrEqual":"9.16.50","status":"affected","versionType":"custom"},{"version":"9.18.0","lessThanOrEqual":"9.18.39","status":"affected","versionType":"custom"},{"version":"9.20.0","lessThanOrEqual":"9.20.13","status":"affected","versionType":"custom"},{"version":"9.21.0","lessThanOrEqual":"9.21.12","status":"affected","versionType":"custom"},{"version":"9.16.8-S1","lessThanOrEqual":"9.16.50-S1","status":"affected","versionType":"custom"},{"version":"9.18.11-S1","lessThanOrEqual":"9.18.39-S1","status":"affected","versionType":"custom"},{"version":"9.20.9-S1","lessThanOrEqual":"9.20.13-S1","status":"affected","versionType":"custom"}],"defaultStatus":"unaffected"}],"metrics":[{"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","baseScore":8.6,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-341","description":"CWE-341 Predictable from Observable State"}]}],"descriptions":[{"lang":"en","value":"In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use.\nThis issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1."}],"impacts":[{"descriptions":[{"lang":"en","value":"BIND can be tricked into caching attacker responses, if the spoofing is successful."}]}],"workarounds":[{"lang":"en","value":"No workarounds known."}],"exploits":[{"lang":"en","value":"We are not aware of any active exploits."}],"solutions":[{"lang":"en","value":"Upgrade to the patched release most closely related to your current version of BIND 9: 9.18.41, 9.20.15, 9.21.14, 9.18.41-S1, or 9.20.15-S1."}],"credits":[{"lang":"en","value":"ISC would like to thank Prof. Amit Klein and Omer Ben Simhon from Hebrew University of Jerusalem for bringing this vulnerability to our attention."}],"references":[{"url":"https://kb.isc.org/docs/cve-2025-40780","name":"CVE-2025-40780","tags":["vendor-advisory"]}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-10-22T17:27:36.366032Z","id":"CVE-2025-40780","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-10-22T17:27:49.476Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2025/10/22/1"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-04T21:10:16.728Z"}}]}}