PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-0430 Belledonne Communications CVE debrief

A NULL pointer dereference vulnerability in Belledonne Communications Linphone-Desktop 5.2.6 allows remote, unauthenticated attackers to trigger a denial-of-service condition. The vulnerability was disclosed by CISA on January 14, 2025, with a CVSS 3.1 score of 7.5 (HIGH). The attack vector is network-based, requires no privileges or user interaction, and results in complete loss of availability. Belledonne Communications has addressed this issue in linphone-sdk version 5.3.99.

Vendor
Belledonne Communications
Product
Linphone-Desktop
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-01-14
Original CVE updated
2025-01-14
Advisory published
2025-01-14
Advisory updated
2025-01-14

Who should care

Organizations using Linphone-Desktop 5.2.6 for VoIP communications, particularly in operational technology (OT) environments where CISA advisories are relevant. System administrators managing softphone deployments, security teams monitoring VoIP infrastructure for availability risks, and users relying on Linphone for critical communications should prioritize patching.

Technical summary

The vulnerability exists in the linphone-sdk component used by Linphone-Desktop 5.2.6. A NULL pointer dereference occurs when processing network input, allowing a remote attacker to crash the application without authentication. The CVSS 3.1 score of 7.5 reflects the high availability impact combined with the low attack complexity and lack of required privileges or user interaction. The attack surface is the network interface handling SIP/VoIP communications. Successful exploitation results in application termination, disrupting voice and video communications for affected users.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade to linphone-sdk version 5.3.99 or later to obtain the vendor fix
  • If immediate patching is not feasible, restrict network access to Linphone-Desktop instances to trusted sources only
  • Monitor for abnormal application crashes or unexpected termination of Linphone-Desktop processes
  • Review CISA's ICS recommended practices for additional defense-in-depth strategies
  • Apply principle of least privilege for VoIP/SIP communications infrastructure

Evidence notes

The vulnerability is specifically identified as a NULL Dereference in Linphone-Desktop version 5.2.6. CISA's CSAF data confirms the affected product and vendor attribution with high confidence. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates network accessibility with low attack complexity, no required privileges or user interaction, and high impact to availability only.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-0430 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-0430

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-0430 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-0430

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-014-04.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-014-04

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.