CVE DATABASE / CVE-2020-3161

CVE-2020-3161

Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability

CVSS 9.8 · CRITICAL ⚠ CISA KEV — ACTIVELY EXPLOITED

On the CISA KEV catalog

Confirmed exploited in the wild. Added 2021-11-03. Federal remediation due 2022-05-03.
Required action: Apply updates per vendor instructions.

Summary

A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web server of a targeted device. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a DoS condition.

CVSS 3.1 breakdown

Base score	9.8 (CRITICAL)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector	NETWORK
Attack complexity	LOW
Privileges required	NONE
User interaction	NONE
Scope	UNCHANGED
Confidentiality	HIGH
Integrity	HIGH
Availability	HIGH

Weakness type (CWE)

CWE-20

Affected products

Cisco ip phone 8865 firmwareCisco ip phone 8865Cisco ip phone 8851 firmwareCisco ip phone 8851Cisco ip phone 7841 firmwareCisco ip phone 7841Cisco ip phone 7821 firmwareCisco ip phone 7821Cisco ip phone 8811 firmwareCisco ip phone 8811Cisco ip phone 8861 firmwareCisco ip phone 8861Cisco ip phone 8845 firmwareCisco ip phone 8845Cisco ip phone 7861 firmwareCisco ip phone 7861Cisco ip phone 8841 firmwareCisco ip phone 8841Cisco ip phone 7811 firmwareCisco ip phone 7811

Check this CVE live

Use our free CVE Lookup tool for the latest NVD record, or browse the full CISA KEV catalog.

References

Data: NIST NVD + CISA KEV. NVD last modified 2025-10-28. Always verify against the vendor advisory before acting.