MediumPublic exploit

DNS communication loop denial of service in Poslib, Axis Network products, and Men & Mice Suite

IdentifiersCVE-2004-0789CWE-835

CVE-2004-0789 is a denial-of-service vulnerability affecting multiple DNS protocol implementations, including Poslib 1.0.2-1 and earlier as used by Posadis, Axis Network products before firmware 3.13, and Men & Mice Suite 2.2x before 2.2.3 and 3.5.x before 3.5.2. The flaw allows a remote attacker to induce a communications loop between DNS components by sending crafted traffic, specifically DNS query packets with localhost spoofed as the source address or a response packet that causes another response packet to be generated. This results in repeated packet exchange and uncontrolled processing rather than normal request/response termination.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation causes denial of service through sustained CPU utilization and network bandwidth consumption. The affected DNS implementation can be driven into a self-sustaining or repeated communication loop, degrading service availability and potentially affecting adjacent systems or network segments due to excess traffic generation.

Mitigation

If you can’t patch tonight, do this now.

Filter or block spoofed DNS traffic, especially packets claiming a localhost source address, at network boundaries and on the host where possible. Restrict exposure of affected DNS services to trusted networks, apply ingress/egress anti-spoofing controls, and monitor for abnormal recursive or reflexive DNS traffic patterns indicative of packet loops. Rate limiting and segmentation can reduce operational impact until patches are applied.

Remediation

Patch, then assume compromise.

Upgrade to a fixed version: Axis Network products should be updated to firmware 3.13 or later; Men & Mice Suite should be updated to 2.2.3 or later in the 2.2 branch, or 3.5.2 or later in the 3.5 branch; Poslib/Posadis deployments should be updated beyond Poslib 1.0.2-1 to a version that corrects the loop condition. Where vendor fixes are unavailable, replace or disable the vulnerable DNS component.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

CVE-2004-0789-DDOSMaturityPoCVerified exploit

This repository contains a simple proof-of-concept exploit script (exploit.py) and a README.md with usage instructions. The exploit is written in Python and uses the Scapy library to send a user-specified number of DNS queries to a target DNS server. Each query uses a randomly generated subdomain, which can be used to stress the DNS server or potentially perform a denial-of-service attack by causing cache misses and increased load. The script prompts the user for the target DNS server's IP address and the number of requests to send. There are no hardcoded endpoints; the target is supplied at runtime. The repository is minimal, with only the exploit script and a brief README.

HimmeL-ByteDisclosed May 6, 2025pythonnetwork

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Axis Communications2100 Network Camerahardware

Axis Communications2110 Network Camerahardware

Axis Communications2120 Network Camerahardware

Axis Communications2400 Video Serverhardware

Axis Communications2401 Video Serverhardware

Axis Communications2420 Network Camerahardware

Axis Communications2460 Network Dvrhardware

DelegateDelegateapplication

DnrdDnrdapplication

Don MooreMydnsapplication

MaradnsMaradnsapplication

PliantPliant Dns Serverapplication

PosadisPosadisapplication

QbikWingateapplication

Team JohnlongRaidendnsdapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

2 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2