Cisco IP Phones CVE-2025-20351

Exploitation requires that the affected phone (Desk Phone 9800, IP Phone 7800/8800, or Video Phone 8875 running Cisco SIP Software) be registered to Cisco Unified Communications Manager AND have the Web Access feature enabled - Web Access is DISABLED BY DEFAULT, so default deployments are not exposed. It is reflected XSS requiring active user interaction (UI:R): the attacker must persuade an existing web-UI user to click a crafted link, and impact is confined to that user's browser context (no device code execution or OS compromise). These two limiting factors - non-default configuration plus required user interaction - substantially reduce realistic risk below the raw 6.1 score.

This is a moderate, not high-priority, issue once all signals are weighed together. The CVSS 3.1 base score of 6.1 (vendor-assigned by Cisco PSIRT) reflects a reflected/DOM XSS: network attack vector (AV:N) but with mandatory user interaction (UI:R), no privileges (PR:N), low complexity (AC:L), and only low confidentiality and integrity impact (C:L/I:L/A:N) with a scope change (S:C) because script executes in the victim's browser context rather than on the device OS. EPSS is low at 0.29% (19th percentile), and there is no CISA KEV listing and no identified public exploit - so no public exploit identified at time of analysis and no evidence of active exploitation. The signals are mutually consistent: a low-impact, interaction-dependent XSS that is unlikely to be mass-exploited. Importantly, real-world exploitability is further constrained by non-CVSS prerequisites stated in the description: the phone must be registered to Cisco Unified Communications Manager AND have Web Access enabled, which is DISABLED BY DEFAULT - this materially lowers the exposed population below what AV:N/PR:N alone implies. One data-quality caveat: the single reference advisory URL is slugged 'cisco-sa-phone-dos' (denial of service), which does not match an XSS/CWE-79 finding - verify the correct advisory with Cisco, as the linked bulletin may describe a different issue.

An attacker crafts a malicious URL targeting the phone's web UI and uses social engineering to persuade an authenticated web-UI user (typically an administrator on the same network) to click it. When the victim opens the link, unsanitized input is reflected and arbitrary script executes in the victim's browser session, letting the attacker read browser-based information or act within the web UI context. No public exploit code is identified at time of analysis.