CVE-2020-25681

highpriority · attend · 61EPSS 0.841 · 100 %ileDEEURUUS
grimoire priorityP1 · Urgent
Exploitable?
—
no known exploitation
Likely / severe?
84.1% (100th) EPSS
CVSS 8.3 · high
Is it mine?
52 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

02

cvss

Technical severity, 0–10. One row per scoring source.

8.3
010

base score 0–10 · higher = more severe · hover a vector to decode

v2.08.3highAV:N/AC:M/Au:N/C:P/I:P/A:Cprimary · NVD / NIST USexploitability 8.6 · impact 8.5
v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.2 · impact 5.9
v3.18.1highAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)
v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Cisco PSIRT US
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-122USCWE-122US
04

affected products (52)

Products and version ranges known to be affected.

showing 20 of 52
05

advisories (2)

Vendor and ecosystem advisories describing this.

  • WID-SEC-W-2023-2836dnsmasq: Mehrere SchwachstellenDeutsch2021-01-18csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in dnsmasq und mehreren Cisco Produkten ausnutzen, um beliebigen Programmcode auszuführen und um den DNS Cache zu manipulieren.

  • cisco-sa-dnsmasq-dns-2021-c5mrdf3gMultiple Vulnerabilities in dnsmasq DNS Forwarder Affecting Cisco Products: January 20212021-01-19csaf · cisco_csafUS

    A set of previously unknown vulnerabilities in the DNS forwarder implementation of dnsmasq were disclosed on January 19, 2021. The vulnerabilities are collectively known as DNSpooq. Exploitation of these vulnerabilities could result in remote code execution or denial of service (DoS), or may allow an attacker to more easily forge DNS answers that can poison DNS caches, depending on the specific vulnerability. Multiple Cisco products are affected by these vulnerabilities. Cisco will release software updates that address these vulnerabilities. Any workarounds for a specific Cisco product or service will be documented in the relevant Cisco bugs, which are identified in the Vulnerable Products ["#vp"] section of this advisory. Note: At the time of publication, no Cisco products were found to be affected by the remote code execution and DoS vulnerabilities, which are identified by the following Common Vulnerabilities and Exposures (CVE) IDs: CVE-2020-25681 CVE-2020-25682 CVE-2020-25683 CVE-2020-25687

06

also known as (4)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducert_bundcisco_csafNVDCVE.orgMITRE
published 2021-01-20modified 2026-06-17
08

references (39)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan