Description

The configuration of the MDNS services allows an attacker to spoof IP addresses effectively hijacking them or causing a denial-of-service. Alternatively, due to a lack of certain security measures, it is possible to intercept requests to mDNS services and obtain information about the connected devices.

Impact

Attack vector because it is possible to extract administrative credentials from the process cache.

Recommendation

Disable LLMR and NBT-NS. Configure the firewall to filter incoming connections from UDP 5353 port.

Threat

Anonymous attacker from local network.

Expected Remediation Time

⏱️ 60 minutes.

Requirements

Fixes