ZeroDay Findings
Sign inSign up

Findings

CVE-2020-3161

Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability

Published Apr 15, 2020 · updated Jun 16, 2026 · cisco ip phone 8865 firmware

A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web server of a targeted device. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a DoS condition.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 15, 2020 · Catalog

    Detected

    A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the we

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 3, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the we

Required action

Apply updates per vendor instructions.

CISA due date May 3, 2022

Affected

  • cpe cisco/ip phone 7821 firmware11.0\(1\)
  • cpe cisco/ip phone 7841 firmware11.0\(1\)
  • cpe cisco/ip phone 7861 firmware11.0\(1\)
  • cpe cisco/ip phone 8811 firmware10.3\(1\)es14
  • cpe cisco/ip phone 8845 firmware10.3\(1\)es14
  • cpe cisco/ip phone 8851 firmware10.3\(1\)es14
  • cpe cisco/ip phone 8851 firmware11.0\(1\)
  • cpe cisco/ip phone 8851 firmware11.0\(5\)sr1
  • cpe cisco/ip phone 8861 firmware10.3\(1\)es14
  • cpe cisco/ip phone 8865 firmware10.3\(1\)es14
  • cpe cisco/ip phone 8865 firmware11.0\(1\)
  • cpe cisco/ip phone 8865 firmware11.0\(5\)sr1
  • vendor Cisco Cisco IP Phonesversion unspecified

Sources

  • CISA KEVCVE-2020-3161

    Cisco IP Phones contain an improper input validation vulnerability for HTTP requests. Exploitation could allow an attacker to execute code remotely with root privileges or cause a denial-of-service (DoS) condition.

    cisa.gov
  • CVE.orgCVE-2020-3161

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2020-3161

    30-day exploitation probability 83.9%

    first.org
  • Exploit Database48342

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDCVE-2020-3161

    A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper inp

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/157265/Cisco-IP-Phone-11.7-Denial-Of-Service.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References