CVE-2025-20165 is a denial-of-service vulnerability in the SIP processing subsystem of Cisco BroadWorks Network Servers. This flaw, caused by improper memory handling, allows an unauthenticated, remote attacker to exhaust system memory by sending a high volume of SIP requests, leading to a DoS condition requiring manual recovery. The vulnerability has a CVSS score of 7.5 (High), indicating a critical impact. It can be exploited remotely with low attack complexity, requiring no user interaction or privileges, and results in a complete loss of availability. While not currently listed in CISA's KEV catalog, there is community discussion and media coverage suggesting heightened awareness. Although no Metasploit, Nuclei, or ExploitDB modules are publicly available, one media article mentions the existence of Proof-of-Concept exploit code.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2024.11CPE matchmatch criteria | cpe:2.3:a:cisco:broadworks_network_server:*:*:*:*:release_independent:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.