CVE-2020-17470

MEDIUM 5.3CVE-2020-17470 · Published 11/12/2020 · updated 17/06/2026

In short

CVE-2020-17470 is a MEDIUM (CVSS 5.3) vulnerability affecting fnet (butok).
Chance of exploitation in the next 30 days (EPSS): 2.1%, higher than 81.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
fnet butok	`≤ 4.6.4`	No fix yet

Description

An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not set sufficiently random transaction IDs (they are always set to 1 in _fnet_dns_poll in fnet_dns.c). This significantly simplifies DNS cache poisoning attacks.

References

fnet.sourceforge.net/manual/fnet_history.html · Release Notes
us-cert.cisa.gov/ics/advisories/icsa-20-343-01 · Third Party Advisory
kb.cert.org/vuls/id/815128 · Third Party Advisory

More vulnerabilities in fnet

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

fnet

butok

≤ 4.6.4

No fix yet

More vulnerabilities in fnet

See all →