CVE-2023-28456

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-28456

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

A

n issue was discovered in Technitium through 11.0.2. It enables attackers to launch amplification attacks (3 times more than other "golden model" software like BIND) and cause potential DoS.

References
Link Resource
https://gist.github.com/idealeer/89947ca07836fd0f7e9761198ca9a0f3 Third Party Advisory
https://technitium.com/dns/ Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:technitium:dnsserver:*:*:*:*:*:*:*:*
History

22 Apr 2025, 14:19

Type Values Removed Values Added
CPE cpe:2.3:a:technitium:dnsserver:*:*:*:*:*:*:*:*
References () https://gist.github.com/idealeer/89947ca07836fd0f7e9761198ca9a0f3 - () https://gist.github.com/idealeer/89947ca07836fd0f7e9761198ca9a0f3 - Third Party Advisory
References () https://technitium.com/dns/ - () https://technitium.com/dns/ - Product
First Time Technitium
Technitium dnsserver

20 Sep 2024, 12:30

Type Values Removed Values Added
Summary
  • (es) Se descubrió un problema en Technitium a través de la versión 11.0.2. Permite a los atacantes lanzar ataques de amplificación (tres veces más que otros programas de "modelo dorado" como BIND) y provocar posibles ataques de denegación de servicio (DoS).

18 Sep 2024, 18:35

Type Values Removed Values Added
CWE CWE-406
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

18 Sep 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-18 15:15

Updated : 2025-04-22 14:19

NVD link : CVE-2023-28456

Mitre link : CVE-2023-28456

CVE.ORG link : CVE-2023-28456

JSON object : View

Products Affected

technitium

CWE
CWE-406

Insufficient Control of Network Message Volume (Network Amplification)