CVE-2026-47703

Executive Summary

CVE-2026-47703 is a vulnerability in AdGuard Home, a network-wide ad and tracking blocker. The flaw resides in the client-triggered DNS-over-QUIC (DoQ) forwarding path when using a udp:// upstream. By forcing the generation of DNS transaction IDs (dns_id or txid) equal to zero, an attacker can exploit a quoted-port ICMP source-port oracle. This weakens DNS response matching for forwarded queries, potentially allowing an attacker to inject spoofed DNS responses. The vulnerability is fixed in version 0.107.75.

Supply Chain & Package Security

AdGuard Home is distributed as a Go binary. The vulnerability is in the core DNS forwarding logic, not in a third-party package. Users should verify the integrity of the downloaded binary using the official checksums provided by AdGuard.

CVSS Breakdown & Threat Level

The CVSS score is not provided in the NVD data. However, based on the description, the vulnerability has the following characteristics:

• Attack Vector (AV): Network (N) - The attack is initiated over the network.
• Attack Complexity (AC): Low (L) - The attack does not require special conditions.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The vulnerable component is the DNS resolver.
• Confidentiality (C): None (N) - No direct data exposure.
• Integrity (I): High (H) - An attacker can inject false DNS responses.
• Availability (A): None (N) - No direct denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Estimated Base Score: 7.5 (High)

Deep Dive & Mechanics

The vulnerability is in the DoQ (DNS over QUIC) forwarding path. When AdGuard Home receives a DNS query from a client over DoQ and forwards it to an upstream udp:// resolver, it uses a specific transaction ID (dns_id or txid). Under certain conditions, this ID is set to zero.

The key issue is the "quoted-port ICMP source-port oracle." In UDP, the source port is used to match responses to queries. An attacker can send ICMP messages (e.g., ICMP Port Unreachable) that quote the original UDP packet, including the source port. By observing these ICMP messages, the attacker can learn the source port used by AdGuard Home for the forwarded query. Combined with the predictable transaction ID of zero, the attacker can forge a DNS response that matches the expected source port and transaction ID, allowing DNS cache poisoning.

The attack flow:

1. Client sends a DoQ query to AdGuard Home.
2. AdGuard Home forwards the query to a udp:// upstream with dns_id=0 and a specific source port.
3. Attacker sends ICMP messages to the upstream server, quoting the source port.
4. Attacker learns the source port and sends a forged DNS response with dns_id=0 and the correct source port.
5. AdGuard Home accepts the forged response, poisoning its cache.

Vulnerable vs. Patched Code

The vulnerable code is in the DoQ forwarding logic. The fix ensures that transaction IDs are randomized and non-zero.

Vulnerable Code (Conceptual):

// In the DoQ handler
func forwardQuery(query *dns.Msg, upstream string) {
    // Set transaction ID to zero
    query.Id = 0
    // Send via UDP
    conn, _ := net.Dial("udp", upstream)
    conn.Write(query.Pack())
}

Patched Code (Conceptual):

// In the DoQ handler
func forwardQuery(query *dns.Msg, upstream string) {
    // Generate random transaction ID
    query.Id = rand.Uint16()
    // Ensure non-zero
    if query.Id == 0 {
        query.Id = 1
    }
    // Send via UDP
    conn, _ := net.Dial("udp", upstream)
    conn.Write(query.Pack())
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install AdGuard Home version 0.107.74 on a Linux VM.
2. Configure it to use a udp:// upstream (e.g., 8.8.8.8).
3. Set up a client to send DoQ queries.
4. Use a tool like scapy to send ICMP packets and forge DNS responses.

Exploitation Steps:

1. Send a DoQ query to AdGuard Home for a domain like example.com.
2. Observe the source port used by AdGuard Home for the forwarded UDP query.
3. Send an ICMP Port Unreachable message to the upstream server (e.g., 8.8.8.8) with the quoted source port.
4. Forge a DNS response with dns_id=0 and the correct source port, pointing example.com to a malicious IP.
5. Verify that AdGuard Home caches the malicious response.

Example Scapy Script:

from scapy.all import *

# Assume we know the source port (e.g., 12345)
src_port = 12345
# Forged DNS response
dns_response = IP(dst="<AdGuard_IP>", src="8.8.8.8")/UDP(sport=53, dport=src_port)/DNS(
    id=0,
    qr=1,
    qd=DNSQR(qname="example.com"),
    an=DNSRR(rrname="example.com", rdata="1.2.3.4")
)
send(dns_response)

Blue Team

Detection:

• Monitor for DNS queries with dns_id=0 in the forwarded traffic.
• Monitor for ICMP messages that quote UDP source ports from AdGuard Home.
• Use the Sigma rule below to detect anomalous DNS responses.

Mitigation:

• Upgrade to version 0.107.75 immediately.
• If upgrade is not possible, disable DoQ forwarding or use only DoT/DoH upstreams.
• Implement network segmentation to limit exposure.

Indicators of Compromise (IOCs)

• DNS queries with dns_id=0 in UDP traffic from AdGuard Home.
• ICMP Port Unreachable messages quoting UDP source ports from AdGuard Home.
• Unexpected DNS responses with dns_id=0 and matching source ports.
• Log entries showing dns_id=0 in AdGuard Home logs.

Detection Engineering

YARA Rule

rule CVE_2026_47703_DNS_ID_Zero {
    meta:
        description = "Detects DNS packets with transaction ID set to zero, indicating potential exploitation of CVE-2026-47703"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-47703"
    strings:
        $dns_id_zero = { 00 00 } // DNS ID field set to 0x0000
    condition:
        $dns_id_zero at 0
}

Sigma Rule

title: CVE-2026-47703 - DNS Transaction ID Zero
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects DNS queries or responses with transaction ID set to zero, indicating potential exploitation of CVE-2026-47703
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-47703
logsource:
    category: dns
    product: suricata
detection:
    selection:
        dns.id: 0
    condition: selection
falsepositives:
    - Legitimate DNS queries with ID zero (rare)
level: high

Suricata Rule

alert udp any any -> any 53 (msg:"CVE-2026-47703 - DNS Transaction ID Zero"; dns.id:0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade AdGuard Home to version 0.107.75 or later.
2. If upgrade is not possible, disable DoQ forwarding or use only DoT/DoH upstreams.
3. Monitor DNS traffic for transaction IDs equal to zero.

Long-term Measures:

• Implement DNS response validation (e.g., DNSSEC).
• Use network segmentation to isolate DNS infrastructure.
• Regularly update all software components.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact support@valtersit.com.