CVE-2014-4883

MEDIUM 4.3CVE-2014-4883 · Published 28/11/2014 · updated 17/06/2026

In short

CVE-2014-4883 is a MEDIUM (CVSS 4.3) vulnerability affecting lwip (lwip project).
Chance of exploitation in the next 30 days (EPSS): 0.57%, higher than 47.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
lwip lwip_project	`≤ 1.4.1`	No fix yet

Description

resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for man-in-the-middle attackers to conduct cache-poisoning attacks via spoofed reply packets.

References

git.savannah.gnu.org/cgit/lwip.git/commit · Patch
kb.cert.org/vuls/id/210620 · US Government Resource

More vulnerabilities in lwip

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free