Vulnerability Intelligence

CVE-2020-3161

Critical 9.8 Exploited in the wild (KEV)

Published
Last modified
NVD status
Analyzed

CISA KEV catalog

Confirmed active exploitation.

Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.

CISA KEV
Name
Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply updates per vendor instructions.

Description

A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web server of a targeted device. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a DoS condition.

Affected products

cisco: ip phone 8865 firmware; cisco: ip phone 8865; cisco: ip phone 8851 firmware; cisco: ip phone 8851; cisco: ip phone 7841 firmware; cisco: ip phone 7841; cisco: ip phone 7821 firmware; cisco: ip phone 7821; cisco: ip phone 8811 firmware; cisco: ip phone 8811; cisco: ip phone 8861 firmware; cisco: ip phone 8861; cisco: ip phone 8845 firmware; cisco: ip phone 8845; cisco: ip phone 7861 firmware

References5

Metrics

CVSS 3.1
9.8 CRITICAL Score source: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS — exploit probability
84% percentile: 100 · as of 2 November 2026
CWE
CWE-20