CRITICAL🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇵🇱 Wersja polska

CVE-2020-3161

CVSS 9.8v3.1pub. 2020-04-15upd. 2025-10-28

A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web server of a targeted device. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a DoS condition.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Cisco 8831

    HW
    Cisco
    all versions

  • Cisco 8831 Firmware

    OS
    Cisco
    10.3\(1\)es1411.0\(1\)11.0\(5\)sr1

  • Cisco Ip Phone 7811

    HW
    Cisco
    all versions

  • Cisco Ip Phone 7811 Firmware

    OS
    Cisco
    11.0\(1\)

  • Cisco Ip Phone 7821

    HW
    Cisco
    all versions

  • Cisco Ip Phone 7821 Firmware

    OS
    Cisco
    11.0\(1\)

  • Cisco Ip Phone 7841

    HW
    Cisco
    all versions

  • Cisco Ip Phone 7841 Firmware

    OS
    Cisco
    11.0\(1\)

  • Cisco Ip Phone 7861

    HW
    Cisco
    all versions

  • Cisco Ip Phone 7861 Firmware

    OS
    Cisco
    11.0\(1\)

  • Cisco Ip Phone 8811

    HW
    Cisco
    all versions

  • Cisco Ip Phone 8811 Firmware

    OS
    Cisco
    10.3\(1\)es1411.0\(1\)11.0\(5\)sr1

  • Cisco Ip Phone 8821

    HW
    Cisco
    all versions

  • Cisco Ip Phone 8821 Ex

    HW
    Cisco
    all versions

  • Cisco Ip Phone 8821 Ex Firmware

    OS
    Cisco
    10.3\(1\)es1411.0\(1\)11.0\(5\)sr1

  • Cisco Ip Phone 8821 Firmware

    OS
    Cisco
    10.3\(1\)es1411.0\(1\)11.0\(5\)sr1

  • Cisco Ip Phone 8841

    HW
    Cisco
    all versions

  • Cisco Ip Phone 8841 Firmware

    OS
    Cisco
    10.3\(1\)es1411.0\(1\)11.0\(5\)sr1

  • Cisco Ip Phone 8845

    HW
    Cisco
    all versions

  • Cisco Ip Phone 8845 Firmware

    OS
    Cisco
    10.3\(1\)es1411.0\(1\)11.0\(5\)sr1

  • Cisco Ip Phone 8851

    HW
    Cisco
    all versions

  • Cisco Ip Phone 8851 Firmware

    OS
    Cisco
    10.3\(1\)es1411.0\(1\)11.0\(5\)sr1

  • Cisco Ip Phone 8861

    HW
    Cisco
    all versions

  • Cisco Ip Phone 8861 Firmware

    OS
    Cisco
    10.3\(1\)es1411.0\(1\)11.0\(5\)sr1

  • Cisco Ip Phone 8865

    HW
    Cisco
    all versions

  • Cisco Ip Phone 8865 Firmware

    OS
    Cisco
    10.3\(1\)es1411.0\(1\)11.0\(5\)sr1

CISA KEV — detailsi

Vendori
Cisco ↗
Producti
Cisco IP Phones
Added to KEVi
November 3, 2021
Remediation deadline (US Federal)i
May 3, 2022(overdue)
Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

Cisco IP Phones contain an improper input validation vulnerability for HTTP requests. Exploitation could allow an attacker to execute code remotely with root privileges or cause a denial-of-service (DoS) condition.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
⏰CISA DEADLINE: 3 maja 2022
Tags
DoS
CWE
References

Related vulnerabilities

CVE-2017-12240CRITICAL9.8⚠ KEVPL ✓same product

Buffer overflow w DHCP relay Cisco IOS — RCE bez uwierzytelnienia

CVE-2023-20078CRITICAL9.8PL ✓same product

RCE i DoS w interfejsie webowym telefonów Cisco IP Phone serii 6800

CVE-2023-20079CRITICAL9.8PL ✓same product

RCE i DoS w interfejsie webowym telefonów Cisco IP Phone serii 6800

CVE-2022-20775HIGH7.8⚠ KEVsame product

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain eleva...

CVE-2018-0154HIGH7.5⚠ KEVsame product

A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco I...