Vulnerability Description
A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web server of a targeted device. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a DoS condition.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Ip Phone 8865 Firmware | 10.3\(1\)es14 |
| Cisco | Ip Phone 8865 | - |
| Cisco | Ip Phone 8851 Firmware | 10.3\(1\)es14 |
| Cisco | Ip Phone 8851 | - |
| Cisco | Ip Phone 7841 Firmware | 11.0\(1\) |
| Cisco | Ip Phone 7841 | - |
| Cisco | Ip Phone 7821 Firmware | 11.0\(1\) |
| Cisco | Ip Phone 7821 | - |
| Cisco | Ip Phone 8811 Firmware | 10.3\(1\)es14 |
| Cisco | Ip Phone 8811 | - |
| Cisco | Ip Phone 8861 Firmware | 10.3\(1\)es14 |
| Cisco | Ip Phone 8861 | - |
| Cisco | Ip Phone 8845 Firmware | 10.3\(1\)es14 |
| Cisco | Ip Phone 8845 | - |
| Cisco | Ip Phone 7861 Firmware | 11.0\(1\) |
| Cisco | Ip Phone 7861 | - |
| Cisco | Ip Phone 8841 Firmware | 10.3\(1\)es14 |
| Cisco | Ip Phone 8841 | - |
| Cisco | Ip Phone 7811 Firmware | 11.0\(1\) |
| Cisco | Ip Phone 7811 | - |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/157265/Cisco-IP-Phone-11.7-Denial-Of-ServicExploitThird Party AdvisoryVDB Entry
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vVendor Advisory
- http://packetstormsecurity.com/files/157265/Cisco-IP-Phone-11.7-Denial-Of-ServicExploitThird Party AdvisoryVDB Entry
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-US Government Resource
FAQ
What is CVE-2020-3161?
CVE-2020-3161 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a den...
How severe is CVE-2020-3161?
CVE-2020-3161 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2020-3161?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Ip Phone 8865 Firmware, Cisco Ip Phone 8865, Cisco Ip Phone 8851 Firmware, Cisco Ip Phone 8851, Cisco Ip Phone 7841 Firmware.