CVEvulnerability

CVE-2020-3161

9.8 CRITICAL Known exploited Published 2020-04-15 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability — Cisco Cisco IP Phones

Cisco IP Phones contain an improper input validation vulnerability for HTTP requests. Exploitation could allow an attacker to execute code remotely with root privileges or cause a denial-of-service (DoS) condition.

Added to KEV
2021-11-03
Remediation due
2022-05-03
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2020-3161
Status
Analyzed
Published
2020-04-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-20

Description

A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web server of a targeted device. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a DoS condition.

Affected configurations

• cisco ip phone 8865 firmware 10.3\(1\)es14 • cisco ip phone 8865 firmware 11.0\(1\) • cisco ip phone 8865 firmware 11.0\(5\)sr1 • cisco ip phone 8851 firmware 10.3\(1\)es14 • cisco ip phone 8851 firmware 11.0\(1\) • cisco ip phone 8851 firmware 11.0\(5\)sr1 • cisco ip phone 7841 firmware 11.0\(1\) • cisco ip phone 7821 firmware 11.0\(1\) • cisco ip phone 8811 firmware 10.3\(1\)es14 • cisco ip phone 8811 firmware 11.0\(1\) • cisco ip phone 8811 firmware 11.0\(5\)sr1 • cisco ip phone 8861 firmware 10.3\(1\)es14 • cisco ip phone 8861 firmware 11.0\(1\) • cisco ip phone 8861 firmware 11.0\(5\)sr1 • cisco ip phone 8845 firmware 10.3\(1\)es14 • cisco ip phone 8845 firmware 11.0\(1\) • cisco ip phone 8845 firmware 11.0\(5\)sr1 • cisco ip phone 7861 firmware 11.0\(1\) • cisco ip phone 8841 firmware 10.3\(1\)es14 • cisco ip phone 8841 firmware 11.0\(1\) • cisco ip phone 8841 firmware 11.0\(5\)sr1 • cisco ip phone 7811 firmware 11.0\(1\) • cisco ip phone 8821 firmware 10.3\(1\)es14 • cisco ip phone 8821 firmware 11.0\(1\) • cisco ip phone 8821 firmware 11.0\(5\)sr1 • cisco ip phone 8821-ex firmware 10.3\(1\)es14 • cisco ip phone 8821-ex firmware 11.0\(1\) • cisco ip phone 8821-ex firmware 11.0\(5\)sr1 • cisco 8831 firmware 10.3\(1\)es14 • cisco 8831 firmware 11.0\(1\) • cisco 8831 firmware 11.0\(5\)sr1

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

Referenced by CWE · observed example (1)

  • CWE-20 Improper Input Validation weakness

References