The vulnerability causes the DNS stub resolver in Zephyr to bind a single UDP socket per server during initialization and to keep the local port constant across all subsequent queries. Because only the 16‑bit transaction identifier varies, an attacker who can reach the device over UDP can easily learn the fixed source port and then flood forged responses that match the identifier or the CRC of the queried name. Successful forgery results in the resolver accepting the attacker‑chosen DNS records, which may be cached for the record’s TTL. Although TLS validation mitigates some downstream effects, the ability to redirect name resolution can undermine application integrity and facilitate phishing or protocol hijacking.

This issue affects devices running Zephyr Project RTOS where the core DNS resolver is enabled. No specific firmware version is listed; the problem exists in all releases that use the unpatched resolver code. Vendors should consult the Zephyr security advisory GHSA‑vwgx-h8w3-xwj7 for the applicable patch.

The CVSS score of 6.5 indicates moderate to high risk, while the EPSS score is not reported. The vulnerability is not present in CISA’s KEV catalog yet. The attack requires network access to the target device, which can be achieved from the same LAN, Wi‑Fi, or mesh segment, or from any routable address. With the predictable port and the small identifier space, an off‑path attacker can bootstrap solutions by probing the UDP range, then race legitimate responses. While the exploit is feasible, it relies on the attacker being able to send many UDP packets and win a race on the 16‑bit identifier, which mitigates the likelihood compared to a direct remote execution attack. Nonetheless, the risk remains significant for devices exposed to untrusted networks.