CVE-2025-20165
Cisco Broadworks Network Server ≤ 2024.11
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2025-20165 is a high-severity Memory Allocation with Excessive Size Value (CWE-789) vulnerability in Cisco Broadworks Network Server. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked in the top 45% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SC-6 (Resource Availability) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A vulnerability in the SIP processing subsystem of Cisco BroadWorks stems from improper memory handling for certain SIP requests. The affected component is the Network Servers that handle SIP traffic, where exhaustion of allocated memory can occur under sustained load.
An unauthenticated remote attacker can exploit the flaw by sending a high volume of SIP requests to an affected system. Successful exploitation exhausts memory on the Network Servers, halting processing of incoming requests and producing a denial-of-service condition that requires manual intervention to restore service. The issue carries a CVSS 3.1 score of 7.5 with network attack vector, low complexity, and no required privileges or user interaction.
The Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-sip-dos-mSySbrmt addresses the vulnerability. The associated EPSS score remains flat at a peak and current value of 0.0306, indicating no material increase in observed exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2157
Vulnerability Data
A vulnerability in the SIP processing subsystem of Cisco BroadWorks could allow an unauthenticated, remote attacker to halt the processing of incoming SIP requests, resulting in a denial of service (DoS) condition. This vulnerability is due to improper memory handling…
more
for certain SIP requests. An attacker could exploit this vulnerability by sending a high number of SIP requests to an affected system. A successful exploit could allow the attacker to exhaust the memory that was allocated to the Cisco BroadWorks Network Servers that handle SIP traffic. If no memory is available, the Network Servers can no longer process incoming requests, resulting in a DoS condition that requires manual intervention to recover.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly rejects or bounds untrusted size values before any allocation occurs.
Resource quotas and priority allocation limit the system-wide impact of an oversized request.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent coding flaws that trust unvalidated size values for allocations.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect and block excessive allocation flaws before deployment.
Secure development lifecycle includes input validation and size checks that prevent unbounded allocations.
Application security requirements mandate bounds checking on size parameters to avoid excessive memory allocation.
Secure architecture principles require resource-limit enforcement that mitigates uncontrolled memory requests.
Secure coding standards directly prohibit allocating memory from untrusted size values without validation.
Capacity management monitors overall resource use but does not prevent individual allocation bugs.