PT-2025-30267 · Recursor+2 · Recursor+2

Xiang Li · Published 2025-07-21 · Updated 2025-10-07 · CVE-2025-30192

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions versions prior to the updated version

Description An attacker spoofing responses to ECS-enabled requests sent by the Recursor may succeed. The updated version includes mitigations against spoofing attempts of ECS-enabled queries by chaining ECS-enabled requests and enforcing stricter validation of received responses. The most strict mitigation is enabled when the outgoing.edns subnet harden setting is enabled.

Recommendations Update to the latest version to apply the mitigations. Enable the outgoing.edns subnet harden setting.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

BDU:2025-12940

CVE-2025-30192

OPENSUSE-SU-2025:15478-1

Affected Products

Debian

Recursor

Red Os

References · 14

• https://ubuntu.com/security/CVE-2025-30192 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15478-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30192 · Security Note
• https://bdu.fstec.ru/vul/2025-12940 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-30192 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-30192 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-30192 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-30192 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-30192 · Security Note
• https://redos.red-soft.ru/support/secure · Note
• https://suse.com/security/cve/CVE-2025-30192 · Note
• https://twitter.com/VulmonFeeds/status/1947294810198454431 · Twitter Post
• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-04.html · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-pdns-recursor-cve-2025-30192 · Note