Skip to content
fr Sign in
9.8 Critical Exploited

CVE-2020-3161 Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability

Active exploitation observed

· CISA KEV catalogue
Required action Apply updates per vendor instructions.
Ransomware campaigns Not observed so far
Weakness CWE-20

Description

A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web server of a targeted device. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a DoS condition.

Affected products and versions

Product Affected versions Fixed in
Cisco IP phone Versions not published

References

Timeline

  1. Published
  2. Added to the KEV catalogue
  3. Last modified

Other CVEs of Cisco IP phone

The 2 CVEs of Cisco IP phone →
CVE-2020-3111 A vulnerability in the Cisco Discovery Protocol implementation for the Cisco IP Phone could allow an unauthenticated,… 8.8 High
Track this CVE