A critical domain name system (DNS) vulnerability identified in a great deal of well-known IoT devices and routers could allow threat actors to redirect victims towards spoofed malicious web servers and websites to conduct a multitude of different attacks and compromises. The flaw, tracked as CVE-2022-05-02, exists in a C standard library for embedded systems called uClibc, and its DNS implementation allows the library to perform functions like DNS lookups and translating IP addresses to website domain names. Researchers from Nozomi Networks performed an internal DNS lookup function and realized that the transaction ID from the request was predictable, making the brute-forcing of the 16-bit source port value a possibility that could allow attackers to perform DNS poisoning. Once redirected, the malicious website can force an authenticated response, execute malware on the victim’s device, spy on communications, run scripts to pilfer sensitive information, and much more. At this time there is no available patch or mitigation technique, and due to the scale of affected devices, the brands and models have not been disclosed to the public due to the threat of compromise. The CTIX team urges our readers to keep an eye out for IoT firmware releases, and we will provide an update to this piece as the patches become available and specific devices are identified.