Back

CVE-2020-3161

CRITICAL CISA KEV

A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web server of a targeted device. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a DoS condition.

Published: Apr 15, 2020 Modified: Jun 17, 2026
CWE-20 CWE-20

CVSS Metrics

CVSSv3
Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (31)

Vendor Product Version
cisco ip_phone_8865_firmware 10.3\(1\)es14
cisco ip_phone_8865_firmware 11.0\(1\)
cisco ip_phone_8865_firmware 11.0\(5\)sr1
cisco ip_phone_8851_firmware 10.3\(1\)es14
cisco ip_phone_8851_firmware 11.0\(1\)
cisco ip_phone_8851_firmware 11.0\(5\)sr1
cisco ip_phone_7841_firmware 11.0\(1\)
cisco ip_phone_7821_firmware 11.0\(1\)
cisco ip_phone_8811_firmware 10.3\(1\)es14
cisco ip_phone_8811_firmware 11.0\(1\)
cisco ip_phone_8811_firmware 11.0\(5\)sr1
cisco ip_phone_8861_firmware 10.3\(1\)es14
cisco ip_phone_8861_firmware 11.0\(1\)
cisco ip_phone_8861_firmware 11.0\(5\)sr1
cisco ip_phone_8845_firmware 10.3\(1\)es14
cisco ip_phone_8845_firmware 11.0\(1\)
cisco ip_phone_8845_firmware 11.0\(5\)sr1
cisco ip_phone_7861_firmware 11.0\(1\)
cisco ip_phone_8841_firmware 10.3\(1\)es14
cisco ip_phone_8841_firmware 11.0\(1\)

…and 11 more

GitHub Security Advisory GHSA-74vv-6p4c-8fhj

A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote...

Risk Scores

CVSS Score 9.8 / 10
EPSS Score 83.86%

Top 0% most likely to be exploited

Threat Score 94.4 / 100

CISA Known Exploited

Date Added: 2021-11-03
Due Date: 2022-05-03
Required Action:

Apply updates per vendor instructions.

Data Sources

NVD CISA KEV EPSS GitHub