EUVD-2026-70209
GHSA-998p-wvfv-584p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable HTTP service, no auth required once Web Access is on; impact is availability-only DoS, no C/I compromise.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that are running Cisco Session Initiation Protocol (SIP) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to improper memory management when an affected device processes HTTP packets. An attacker could exploit this vulnerability by sending a continuous stream of crafted HTTP packets to the device. A successful exploit could allow the attacker to cause the affected device to continuously consume memory, resulting in a DoS condition. A manual reboot of the device is required to recover from this condition. Note: For this vulnerability to be exploitable, the phone must be registered to Cisco Unified Communications Manager (Unified CM) and have Web Access enabled. Web Access is disabled by default.
AnalysisAI
Memory exhaustion via crafted HTTP stream causes a persistent denial of service on Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 running Cisco SIP Software, requiring a manual reboot to recover. The root cause is CWE-401 (missing release of memory after effective lifetime) in the device's HTTP packet processing path: an attacker sends a continuous stream of specially crafted HTTP packets, causing the phone to leak memory until it becomes unavailable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two explicit prerequisites must both be satisfied: (1) the affected phone must be registered to Cisco Unified Communications Manager (Unified CM) - standalone or non-UCM deployments are not vulnerable; and (2) Web Access must be explicitly enabled on the phone - this feature is disabled by default and must be deliberately turned on by an administrator. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5) reflects worst-case exposure when Web Access is enabled, which is accurate for that deployment posture but meaningfully overstates risk for the overall installed base since Web Access is disabled by default. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to apply the patched Cisco SIP Software version identified in Cisco Security Advisory cisco-sa-phone-dos-txMYNRzv at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-phone-dos-txMYNRzv; exact patched firmware versions are documented there and should be confirmed against your specific phone model and current firmware train before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your Cisco Unified Communications Manager deployment to identify which Desk Phone 9800 Series, IP Phone 7800/8800 Series, or Video Phone 8875 devices have Web Access explicitly enabled; this non-default configuration is required for exploitation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-401 – Memory Leak
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today