CVE-2020-25705

HIGH

Linux Kernel < 5.10.0 - UDP Port Scan via ICMP Packet Source Port Prediction

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2020-25705. PoCs published by tdwyer, nanopathi.

AI-analyzed exploit summary This repository contains an incomplete PoC for CVE-2020-25705, a DNS cache poisoning vulnerability. The code outlines an algorithm for identifying open UDP ports and spoofing DNS responses but lacks functional implementation details.

Description

A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively bypass source port UDP randomization. Software that relies on UDP source port randomization are indirectly affected as well on the Linux Based Products (RUGGEDCOM RM1224: All versions between v5.0 and v6.4, SCALANCE M-800: All versions between v5.0 and v6.4, SCALANCE S615: All versions between v5.0 and v6.4, SCALANCE SC-600: All versions prior to v2.1.3, SCALANCE W1750D: v8.3.0.1, v8.6.0, and v8.7.0, SIMATIC Cloud Connect 7: All versions, SIMATIC MV500 Family: All versions, SIMATIC NET CP 1243-1 (incl. SIPLUS variants): Versions 3.1.39 and later, SIMATIC NET CP 1243-7 LTE EU: Version

Exploits (3)

nomisec STUB 6 stars
by tdwyer · poc
https://github.com/tdwyer/CVE-2020-25705

This repository contains an incomplete PoC for CVE-2020-25705, a DNS cache poisoning vulnerability. The code outlines an algorithm for identifying open UDP ports and spoofing DNS responses but lacks functional implementation details.

Classification
Stub 80%
Attack Type
Other
Complexity
Complex
Reliability
Theoretical
Target: DNS resolvers (specific version not specified)
No auth needed
Prerequisites: Access to a vulnerable DNS resolver · Ability to spoof UDP packets · Knowledge of closed UDP ports on the victim
devstral-2 · analyzed Feb 16, 2026 Full analysis →
gitlab STUB
by nanopathi · poc
https://gitlab.com/nanopathi/linux-4-19-72_CVE-2020-25705

The repository contains only documentation files and build scripts from a Linux kernel tree, with no actual exploit code or technical analysis related to CVE-2020-25705.

Classification
Stub 90%
Attack Type
Other
Complexity
N/a
Reliability
Theoretical
Target: Linux kernel (version unspecified)
No auth needed
devstral-2 · analyzed Feb 23, 2026 Full analysis →
nomisec WRITEUP
by nanopathi · poc
https://github.com/nanopathi/linux-4.19.72_CVE-2020-25705

The repository contains documentation files from a Linux kernel version 4.19.72, specifically related to ABI stability, admin guides, and hardware-specific documentation. No exploit code or proof-of-concept is present in the provided files.

Classification
Writeup 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Linux kernel 4.19.72
No auth needed
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Third Party Advisory, US Government Resource x_refsource_misc
https://us-cert.cisa.gov/ics/advisories/icsa-21-131-03

Scores

CVSS v3 7.4
EPSS 0.0669
EPSS Percentile 93.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

CWE
CWE-330
Status published
Products (3)
linux/linux_kernel < 5.10.0
redhat/enterprise_linux 7.0
redhat/enterprise_linux 8.0
Published Nov 17, 2020
Tracked Since Feb 18, 2026