CVE-2020-3161
A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web server of a targeted device. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a DoS condition.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Analyzed - psirt@cisco.com
- Published
- 2020-04-15
- Last modified
- 2025-10-21
- Known exploited (CISA KEV)
- since 2021-11-03, action due 2022-05-03: Apply updates per vendor instructions.
- Weaknesses
- CWE-20
Affected products
- 8831 Firmware (Cisco)
- Cisco Ip Phone (Cisco)
- Ip Phone 7811 Firmware (Cisco)
- Ip Phone 7821 Firmware (Cisco)
- Ip Phone 7841 Firmware (Cisco)
- Ip Phone 7861 Firmware (Cisco)
- Ip Phone 8811 Firmware (Cisco)
- Ip Phone 8821-ex Firmware (Cisco)
- Ip Phone 8821 Firmware (Cisco)
- Ip Phone 8841 Firmware (Cisco)
- Ip Phone 8845 Firmware (Cisco)
- Ip Phone 8851 Firmware (Cisco)
- Ip Phone 8861 Firmware (Cisco)
- Ip Phone 8865 Firmware (Cisco)
References
- http://packetstormsecurity.com/files/157265/Cisco-IP-Phone-11.7-Denial-Of-Service.html
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voip-phones-rce-dos-rB6EeRXs
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3161
