CVE-2020-3161Cisco IP Phones Web Server Remote Code Execution and Denial of Service Vulnerability
Updated under an hour ago ()
Does this affect you?
It affects Cisco IP phone and 13 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Nov 3, 2021; federal agencies had to remediate by May 3, 2022. Treat that date as your deadline.
Do this next
Free account, 1 product
A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web server of a targeted device. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a DoS condition.
- CVSS
- 9.8 CRITICAL (v3.0, CNA)CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-20
- Known exploited
- Added to CISA KEV Nov 3, 2021; federal remediation due May 3, 2022Apply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 83.86% (percentile 100)
- Assigned by
- cisco
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Cisco Cisco IP phone cisco:ip_phone (from the name) | all versions | CNA record |
cisco ip_phone_8865_firmware cisco:ip_phone_8865_firmware | 10.3(1)es14; 11.0(1); 11.0(5)sr1 | NVD |
cisco ip_phone_8851_firmware cisco:ip_phone_8851_firmware | 10.3(1)es14; 11.0(1); 11.0(5)sr1 | NVD |
cisco ip_phone_7841_firmware cisco:ip_phone_7841_firmware | 11.0(1) | NVD |
cisco ip_phone_7821_firmware cisco:ip_phone_7821_firmware | 11.0(1) | NVD |
cisco ip_phone_8811_firmware cisco:ip_phone_8811_firmware | 10.3(1)es14; 11.0(1); 11.0(5)sr1 | NVD |
cisco ip_phone_8861_firmware cisco:ip_phone_8861_firmware | 10.3(1)es14; 11.0(1); 11.0(5)sr1 | NVD |
cisco ip_phone_8845_firmware cisco:ip_phone_8845_firmware | 10.3(1)es14; 11.0(1); 11.0(5)sr1 | NVD |
cisco ip_phone_7861_firmware cisco:ip_phone_7861_firmware | 11.0(1) | NVD |
cisco ip_phone_8841_firmware cisco:ip_phone_8841_firmware | 10.3(1)es14; 11.0(1); 11.0(5)sr1 | NVD |
cisco ip_phone_7811_firmware cisco:ip_phone_7811_firmware | 11.0(1) | NVD |
cisco ip_phone_8821_firmware cisco:ip_phone_8821_firmware | 10.3(1)es14; 11.0(1); 11.0(5)sr1 | NVD |
cisco ip_phone_8821-ex_firmware cisco:ip_phone_8821-ex_firmware | 10.3(1)es14; 11.0(1); 11.0(5)sr1 | NVD |
cisco 8831_firmware cisco:8831_firmware | 10.3(1)es14; 11.0(1); 11.0(5)sr1 | NVD |
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voip-phones-rce-dos-rB6EeRXsvendor-advisory, x-refsource-cisco
- http://packetstormsecurity.com/files/157265/Cisco-IP-Phone-11.7-Denial-Of-Service.htmlx-refsource-misc, exploit, third-party-advisory, vdb-entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3161us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.