VULNERABILITY INTELLIGENCE

CVE-2014-4883

CVSS score4.3 MEDIUM
EPSS probability0.57%
CISA KEVNot currently listed
Published2014-11-28
Last modified2026-06-17
CVSS vectorAV:N/AC:M/Au:N/C:N/I:P/A:N

Description

resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for man-in-the-middle attackers to conduct cache-poisoning attacks via spoofed reply packets.

Weakness classification

  • CWE-345: Insufficient Verification of Data Authenticity

Primary references