Cisco IP Phones
CVE-2025-20350
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach phone web UI over network
-
ExploitSend crafted HTTP input
-
ExecutionTrigger stack buffer overflow in parser
-
ImpactDevice reloads (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires two concrete, non-default preconditions explicitly stated by Cisco: (1) the target phone must be registered to Cisco Unified Communications Manager (CUCM), and (2) the 'Web Access' feature must be enabled on the phone - this web UI is DISABLED BY DEFAULT. When these are met, an unauthenticated remote attacker (CVSS PR:N) with network reachability to the phone's HTTP interface can send crafted HTTP input to trigger the buffer overflow; no user interaction or credentials are needed. The key limiting factor is the default-disabled Web Access setting, which means out-of-the-box deployments are not exploitable and only environments that have deliberately enabled the phone web UI are at risk. Impact is limited to availability (device reload/DoS); there is no code execution, data exposure, or integrity impact indicated. |
| Impact | This is a genuine but moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 base vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) describes a network-reachable, low-complexity, unauthenticated flaw with pure availability impact (no confidentiality or integrity loss) - the device reloads, causing a DoS. These raw metrics overstate real-world exposure because the CVSS vector does not capture the two gating preconditions stated in the description: the phone must be registered to Cisco Unified Communications Manager AND have the non-default 'Web Access' feature enabled (disabled by default). The EPSS score of 0.48% (40th percentile) is low, indicating no significant observed or predicted exploitation activity. The vulnerability is NOT in CISA KEV and there is no public exploit identified at time of analysis, so there is no evidence of active exploitation. SSVC-style reasoning: exploitation status = none observed; technical impact = partial (availability-only, recoverable via reload); automatable = plausible given AV:N/AC:L but constrained by the non-default Web Access requirement. Net: the high CVSS reflects network reachability and low complexity, but the low EPSS, absence of KEV/POC, availability-only impact, and the default-disabled web UI mean realistic risk is limited to environments that have deliberately enabled Web Access. Note the apparent tension between CVSS AC:L/PR:N (suggesting trivial exploitation) and the description's configuration prerequisites - the metrics assume Web Access is already enabled. |
| Exploit ScenarioDerived | An attacker with network access to a CUCM-registered Cisco IP phone that has the non-default Web Access feature enabled sends crafted HTTP input to the phone's web UI, triggering a stack buffer overflow (CWE-121) in the HTTP packet parser. The device reloads, dropping the phone from service and causing a denial-of-service condition. No public exploit code is identified at time of analysis, and no authentication or user interaction is required once Web Access is reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Crafted HTTP input sent to the web UI of affected Cisco SIP Software phones triggers a stack-based buffer overflow that reloads the device, producing a denial-of-service condition against voice endpoints. The issue is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and covers Cisco Desk Phone 9800 Series (9841/9851/9861/9871), Cisco IP Phone 7800 Series (7811/7821/7841/7861) and 8800 Series (8811/8821/8832/8841/8845/8851/8861/8865), and Cisco Video Phone 8875 running Cisco SIP Software; impact is limited to availability, with no code execution, data exposure, or integrity impact indicated. Exploitation is gated by two non-default prerequisites that Cisco states explicitly - the phone must be registered to Cisco Unified Communications Manager and the Web Access feature must be enabled (it is disabled by default) - so out-of-the-box deployments are not exposed, and no public exploit code or CISA KEV listing was identified at time of analysis, with EPSS low at 0.48% (40th percentile).
RemediationAI
The most effective immediate action is to keep the phone Web Access feature disabled, which is the default state and a complete mitigation for this vulnerability; administrators should audit CUCM phone configurations and enterprise-wide templates to confirm Web Access has not been enabled, and disable it where it is not operationally required. If the phone web UI is genuinely needed, restrict HTTP reachability with ACLs, firewall rules, or VLAN segmentation so only trusted management subnets can reach the phone's HTTP port, accepting the trade-off that this limits troubleshooting and provisioning workflows and requires accurate inventory of phone IP addresses. Cisco's security advisory (cisco-sa-phone-dos-FPyjLV7A, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-phone-dos-FPyjLV7A) should be consulted for the specific fixed SIP Software release train per model and for upgrade instructions; a patched version is published through that advisory rather than enumerated in the data reviewed here, so verify the exact fixed firmware before scheduling maintenance. Because exploitation is availability-only and requires the non-default Web Access prerequisite, remediating firmware can be scheduled through normal change control, prioritizing any phones that have Web Access enabled.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-121, a stack-based buffer overflow, occurring in the embedded HTTP/web server component of Cisco SIP Software when it processes HTTP packets. Because the affected phones run firmware with a built-in web access interface, malformed or oversized HTTP input is copied into a fixed-size stack buffer before adequate bounds checking, allowing memory corruption that forces the device to reload. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms the overflow is reachable over the network with no authentication (PR:N) and requires no user interaction (UI:N), with a scope-unchanged, availability-only outcome. CPE data enumerates firmware entries for specific models including cisco:desk_phone_9841_firmware, desk_phone_9851_firmware, desk_phone_9861_firmware, desk_phone_9871_firmware, ip_phone_7811_firmware, and ip_phone_8865_firmware (including 14.3(1) and 14.3(1)SR1 builds), reflecting that the defect lives in the shared SIP software image across multiple hardware platforms rather than in a single model. The exploitation path is therefore an HTTP request to the phone's web interface, which is only listening when Web Access is administratively enabled and the endpoint is registered to CUCM; the vulnerable code is otherwise not reachable, which is the primary mitigating control.
Know when Video Phone 8875 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable HTTP parser flaw, unauthenticated and low-complexity once Web Access is enabled, so AV:N/AC:L/PR:N; availability-only reload gives A:H with C:N/I:N.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 running Cisco SIP Software could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.
This vulnerability is due to a buffer overflow when an affected device processes HTTP packets. An attacker could exploit this vulnerability by sending crafted HTTP input to the device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. Note: To exploit this vulnerability, the phone must be registered to Cisco Unified Communications Manager and have Web Access enabled. Web Access is disabled by default.
Executive ViewAI
Cisco SIP Software phones across Desk Phone 9800, IP Phone 7800 and 8800, and Video Phone 8875 models can be forced to reload by an unauthenticated network-based denial-of-service condition, disrupting voice endpoints that organizations rely on for communications. The flaw affects availability only and is gated by non-default Web Access and CUCM registration requirements, but no vendor patch is currently available, so leadership should ensure exposed voice environments are prioritized for mitigation and monitoring.
No vendor-released patch identified at time of analysis. Interim mitigations: disable the Web Access feature on affected Cisco SIP Software phones where not required, restrict access to the phone web UI to trusted management networks, segment voice endpoints from untrusted networks, and monitor for abnormal HTTP requests or unexpected device reloads.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Affected Products (CPE)CVE.org
More in Video Phone 8875 Firmware
View allA vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote
A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform F
Reflected cross-site scripting in the web UI of Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video P
A vulnerability in the XML service of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to initiat
A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phon
A vulnerability in the debug shell of Cisco Video Phone 8875 and Cisco Desk Phone 9800 Series could allow an authenticat
A vulnerability in the directory permissions of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and C
A vulnerability in the directory permissions of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and C
GitHub PoC
Exploit-DB