Cisco IP Phones Web Server Remote Code Execution and Denial of Service Vulnerability
Priority CRITICAL 100Exploited in the wildCWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web server of a targeted device. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a DoS condition.
Why it matters now
Exploitation Active In CISA KEV since 2021-11-03CISA due date 2022-05-03
EPSS 0.83855 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco IP phone | all versions | — | No fix listed | CNA |
- Cisco IP phone VendorCisco Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 44
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:cisco:ip_phone_8865_firmware:10.3\(1\)es14:*:*:*:*:*:*:* | 10.3(1)es14 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:ip_phone_8865_firmware:11.0\(1\):*:*:*:*:*:*:* | 11.0(1) | Vulnerable | Cisco |
| cpe:2.3:o:cisco:ip_phone_8865_firmware:11.0\(5\)sr1:*:*:*:*:*:*:* | 11.0(5)sr1 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:ip_phone_8865:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:ip_phone_8851_firmware:10.3\(1\)es14:*:*:*:*:*:*:* | 10.3(1)es14 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:ip_phone_8851_firmware:11.0\(1\):*:*:*:*:*:*:* | 11.0(1) | Vulnerable | Cisco |
| cpe:2.3:o:cisco:ip_phone_8851_firmware:11.0\(5\)sr1:*:*:*:*:*:*:* | 11.0(5)sr1 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:ip_phone_8851:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:ip_phone_7841_firmware:11.0\(1\):*:*:*:*:*:*:* | 11.0(1) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:ip_phone_7841:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
- cpe:2.3:o:cisco:ip_phone_8865_firmware:10.3\(1\)es14:*:*:*:*:*:*:* Versions 10.3(1)es14 Vulnerable ·Cisco
- cpe:2.3:o:cisco:ip_phone_8865_firmware:11.0\(1\):*:*:*:*:*:*:* Versions 11.0(1) Vulnerable ·Cisco
- cpe:2.3:o:cisco:ip_phone_8865_firmware:11.0\(5\)sr1:*:*:*:*:*:*:* Versions 11.0(5)sr1 Vulnerable ·Cisco
- cpe:2.3:h:cisco:ip_phone_8865:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:ip_phone_8851_firmware:10.3\(1\)es14:*:*:*:*:*:*:* Versions 10.3(1)es14 Vulnerable ·Cisco
- cpe:2.3:o:cisco:ip_phone_8851_firmware:11.0\(1\):*:*:*:*:*:*:* Versions 11.0(1) Vulnerable ·Cisco
- cpe:2.3:o:cisco:ip_phone_8851_firmware:11.0\(5\)sr1:*:*:*:*:*:*:* Versions 11.0(5)sr1 Vulnerable ·Cisco
- cpe:2.3:h:cisco:ip_phone_8851:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:ip_phone_7841_firmware:11.0\(1\):*:*:*:*:*:*:* Versions 11.0(1) Vulnerable ·Cisco
- cpe:2.3:h:cisco:ip_phone_7841:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Show 34 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:cisco:ip_phone_7821_firmware:11.0\(1\):*:*:*:*:*:*:* | 11.0(1) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:ip_phone_7821:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:ip_phone_8811_firmware:10.3\(1\)es14:*:*:*:*:*:*:* | 10.3(1)es14 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:ip_phone_8811_firmware:11.0\(1\):*:*:*:*:*:*:* | 11.0(1) | Vulnerable | Cisco |
| cpe:2.3:o:cisco:ip_phone_8811_firmware:11.0\(5\)sr1:*:*:*:*:*:*:* | 11.0(5)sr1 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:ip_phone_8811:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:ip_phone_8861_firmware:10.3\(1\)es14:*:*:*:*:*:*:* | 10.3(1)es14 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:ip_phone_8861_firmware:11.0\(1\):*:*:*:*:*:*:* | 11.0(1) | Vulnerable | Cisco |
| cpe:2.3:o:cisco:ip_phone_8861_firmware:11.0\(5\)sr1:*:*:*:*:*:*:* | 11.0(5)sr1 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:ip_phone_8861:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:ip_phone_8845_firmware:10.3\(1\)es14:*:*:*:*:*:*:* | 10.3(1)es14 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:ip_phone_8845_firmware:11.0\(1\):*:*:*:*:*:*:* | 11.0(1) | Vulnerable | Cisco |
| cpe:2.3:o:cisco:ip_phone_8845_firmware:11.0\(5\)sr1:*:*:*:*:*:*:* | 11.0(5)sr1 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:ip_phone_8845:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:ip_phone_7861_firmware:11.0\(1\):*:*:*:*:*:*:* | 11.0(1) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:ip_phone_7861:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:ip_phone_8841_firmware:10.3\(1\)es14:*:*:*:*:*:*:* | 10.3(1)es14 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:ip_phone_8841_firmware:11.0\(1\):*:*:*:*:*:*:* | 11.0(1) | Vulnerable | Cisco |
| cpe:2.3:o:cisco:ip_phone_8841_firmware:11.0\(5\)sr1:*:*:*:*:*:*:* | 11.0(5)sr1 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:ip_phone_8841:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:ip_phone_7811_firmware:11.0\(1\):*:*:*:*:*:*:* | 11.0(1) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:ip_phone_7811:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:ip_phone_8821_firmware:10.3\(1\)es14:*:*:*:*:*:*:* | 10.3(1)es14 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:ip_phone_8821_firmware:11.0\(1\):*:*:*:*:*:*:* | 11.0(1) | Vulnerable | Cisco |
| cpe:2.3:o:cisco:ip_phone_8821_firmware:11.0\(5\)sr1:*:*:*:*:*:*:* | 11.0(5)sr1 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:ip_phone_8821:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:ip_phone_8821-ex_firmware:10.3\(1\)es14:*:*:*:*:*:*:* | 10.3(1)es14 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:ip_phone_8821-ex_firmware:11.0\(1\):*:*:*:*:*:*:* | 11.0(1) | Vulnerable | Cisco |
| cpe:2.3:o:cisco:ip_phone_8821-ex_firmware:11.0\(5\)sr1:*:*:*:*:*:*:* | 11.0(5)sr1 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:ip_phone_8821-ex:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:8831_firmware:10.3\(1\)es14:*:*:*:*:*:*:* | 10.3(1)es14 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:8831_firmware:11.0\(1\):*:*:*:*:*:*:* | 11.0(1) | Vulnerable | Cisco |
| cpe:2.3:o:cisco:8831_firmware:11.0\(5\)sr1:*:*:*:*:*:*:* | 11.0(5)sr1 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:8831:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
- cpe:2.3:o:cisco:ip_phone_7821_firmware:11.0\(1\):*:*:*:*:*:*:* Versions 11.0(1) Vulnerable ·Cisco
- cpe:2.3:h:cisco:ip_phone_7821:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:ip_phone_8811_firmware:10.3\(1\)es14:*:*:*:*:*:*:* Versions 10.3(1)es14 Vulnerable ·Cisco
- cpe:2.3:o:cisco:ip_phone_8811_firmware:11.0\(1\):*:*:*:*:*:*:* Versions 11.0(1) Vulnerable ·Cisco
- cpe:2.3:o:cisco:ip_phone_8811_firmware:11.0\(5\)sr1:*:*:*:*:*:*:* Versions 11.0(5)sr1 Vulnerable ·Cisco
- cpe:2.3:h:cisco:ip_phone_8811:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:ip_phone_8861_firmware:10.3\(1\)es14:*:*:*:*:*:*:* Versions 10.3(1)es14 Vulnerable ·Cisco
- cpe:2.3:o:cisco:ip_phone_8861_firmware:11.0\(1\):*:*:*:*:*:*:* Versions 11.0(1) Vulnerable ·Cisco
- cpe:2.3:o:cisco:ip_phone_8861_firmware:11.0\(5\)sr1:*:*:*:*:*:*:* Versions 11.0(5)sr1 Vulnerable ·Cisco
- cpe:2.3:h:cisco:ip_phone_8861:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:ip_phone_8845_firmware:10.3\(1\)es14:*:*:*:*:*:*:* Versions 10.3(1)es14 Vulnerable ·Cisco
- cpe:2.3:o:cisco:ip_phone_8845_firmware:11.0\(1\):*:*:*:*:*:*:* Versions 11.0(1) Vulnerable ·Cisco
- cpe:2.3:o:cisco:ip_phone_8845_firmware:11.0\(5\)sr1:*:*:*:*:*:*:* Versions 11.0(5)sr1 Vulnerable ·Cisco
- cpe:2.3:h:cisco:ip_phone_8845:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:ip_phone_7861_firmware:11.0\(1\):*:*:*:*:*:*:* Versions 11.0(1) Vulnerable ·Cisco
- cpe:2.3:h:cisco:ip_phone_7861:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:ip_phone_8841_firmware:10.3\(1\)es14:*:*:*:*:*:*:* Versions 10.3(1)es14 Vulnerable ·Cisco
- cpe:2.3:o:cisco:ip_phone_8841_firmware:11.0\(1\):*:*:*:*:*:*:* Versions 11.0(1) Vulnerable ·Cisco
- cpe:2.3:o:cisco:ip_phone_8841_firmware:11.0\(5\)sr1:*:*:*:*:*:*:* Versions 11.0(5)sr1 Vulnerable ·Cisco
- cpe:2.3:h:cisco:ip_phone_8841:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:ip_phone_7811_firmware:11.0\(1\):*:*:*:*:*:*:* Versions 11.0(1) Vulnerable ·Cisco
- cpe:2.3:h:cisco:ip_phone_7811:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:ip_phone_8821_firmware:10.3\(1\)es14:*:*:*:*:*:*:* Versions 10.3(1)es14 Vulnerable ·Cisco
- cpe:2.3:o:cisco:ip_phone_8821_firmware:11.0\(1\):*:*:*:*:*:*:* Versions 11.0(1) Vulnerable ·Cisco
- cpe:2.3:o:cisco:ip_phone_8821_firmware:11.0\(5\)sr1:*:*:*:*:*:*:* Versions 11.0(5)sr1 Vulnerable ·Cisco
- cpe:2.3:h:cisco:ip_phone_8821:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:ip_phone_8821-ex_firmware:10.3\(1\)es14:*:*:*:*:*:*:* Versions 10.3(1)es14 Vulnerable ·Cisco
- cpe:2.3:o:cisco:ip_phone_8821-ex_firmware:11.0\(1\):*:*:*:*:*:*:* Versions 11.0(1) Vulnerable ·Cisco
- cpe:2.3:o:cisco:ip_phone_8821-ex_firmware:11.0\(5\)sr1:*:*:*:*:*:*:* Versions 11.0(5)sr1 Vulnerable ·Cisco
- cpe:2.3:h:cisco:ip_phone_8821-ex:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:8831_firmware:10.3\(1\)es14:*:*:*:*:*:*:* Versions 10.3(1)es14 Vulnerable ·Cisco
- cpe:2.3:o:cisco:8831_firmware:11.0\(1\):*:*:*:*:*:*:* Versions 11.0(1) Vulnerable ·Cisco
- cpe:2.3:o:cisco:8831_firmware:11.0\(5\)sr1:*:*:*:*:*:*:* Versions 11.0(5)sr1 Vulnerable ·Cisco
- cpe:2.3:h:cisco:8831:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2021-11-03 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2020-3161
- 2026-10-03 Alias added: GHSA-74vv-6p4c-8fhj
References
Sources
- CVE-2020-3161 · CVE Program
- CVE-2020-3161 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-74vv-6p4c-8fhj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences