An attacker can send specially crafted DNS queries to a DNSdist instance that has domain‑based dynamic rules enabled. The queries trigger the insertion of arbitrary HTML into the internal web dashboard, a form of cross‑site scripting that can allow the attacker to display malicious content or perform actions in the context of users interacting with the dashboard.

The vulnerability affects the PowerDNS DNSdist product. No specific versions are listed, so all releases running DNSdist with enabled dynamic rule features are potentially affected.

With a CVSS score of 3.1, the vulnerability is considered low severity, and its EPSS score is below 1 %, indicating a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to be able to send crafted DNS queries to the DNSdist instance, so it is most relevant for attackers who already have network access to the DNS infrastructure or can influence traffic towards the application.