PoC Exploit Released for BIND 9 Vulnerability that Let Attackers Forge DNS Records

A public exploit code demonstrating how attackers could exploit CVE-2025-40778, a critical vulnerability in BIND 9 that enables DNS cache poisoning.

The Internet Systems Consortium (ISC) initially disclosed this flaw on October 22, revealing a dangerous weakness in the world’s most widely used DNS software.

The vulnerability allows remote, unauthenticated attackers to inject forged DNS records into resolver caches, potentially redirecting millions of users to malicious infrastructure without any user interaction or special network access.

DNS Cache Poisoning Vulnerability Bypasses

The flaw affects supported BIND 9 versions ranging from 9.11.0 through 9.21.14, impacting any resolver performing recursive queries. Fortunately, authoritative-only servers remain unaffected by this issue.

The vulnerability exploits BIND’s handling of unsolicited resource records, allowing attackers to bypass modern DNS security defenses that were implemented following the infamous 2008 Kaminsky vulnerability.

That earlier flaw led to randomized query IDs and source ports, protections that CVE-2025-40778 circumvents entirely.

By crafting specially formatted DNS responses, attackers can poison resolver caches and redirect legitimate traffic to attacker-controlled servers.

The attack carries a CVSS 3.1 severity score of 8.6, classified as high severity, reflecting its potential for widespread impact across internet infrastructure.

The consequences of successful exploitation could be severe. Attackers could redirect all DNS traffic from an affected resolver to malicious endpoints, enabling phishing campaigns, malware distribution, and traffic interception.

Given BIND’s ubiquitous role in internet operations, a single compromised resolver could affect thousands or millions of downstream users and systems. ISC has released patched versions addressing this vulnerability: version 9.18.41, 9.20.15, and 9.21.14.

The company responsible coordinated disclosure through a responsible timeline, issuing early notifications on October 8, revising patch details on October 15, and finalizing disclosure on October 22. Unfortunately, no known workarounds exist for this vulnerability, making immediate patching the only effective mitigation strategy.

As of October 28, no active exploitation in the wild has been confirmed, though the public release of exploit code significantly increases the likelihood of opportunistic attacks.

Security administrators managing recursive DNS resolvers should prioritize immediate upgrades to patched versions matching their deployed BIND installations.

Organizations should implement Domain Name System Security Extensions (DNSSEC) where feasible and conduct comprehensive audits of resolver configurations to ensure recursive queries are disabled on authoritative-only servers.

Network monitoring for anomalous DNS behavior and rapid deployment of security patches remain critical for minimizing exposure to this threat.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.