CVE-2020-3161: Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 83.9% chance of exploitation in the next 30 days.

A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web server of a targeted device. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a DoS condition.

Affected products

• Cisco 8831 Firmware: version 10.3(1)es14 only; version 11.0(1) only; version 11.0(5)sr1 only
• Cisco IP Phone 7811 Firmware: version 11.0(1) only
• Cisco IP Phone 7821 Firmware: version 11.0(1) only
• Cisco IP Phone 7841 Firmware: version 11.0(1) only
• Cisco IP Phone 7861 Firmware: version 11.0(1) only
• Cisco IP Phone 8811 Firmware: version 10.3(1)es14 only; version 11.0(1) only; version 11.0(5)sr1 only
• Cisco IP Phone 8821-Ex Firmware: version 10.3(1)es14 only; version 11.0(1) only; version 11.0(5)sr1 only
• Cisco IP Phone 8821 Firmware: version 10.3(1)es14 only; version 11.0(1) only; version 11.0(5)sr1 only
• Cisco IP Phone 8841 Firmware: version 10.3(1)es14 only; version 11.0(1) only; version 11.0(5)sr1 only
• Cisco IP Phone 8845 Firmware: version 10.3(1)es14 only; version 11.0(1) only; version 11.0(5)sr1 only
• Cisco IP Phone 8851 Firmware: version 10.3(1)es14 only; version 11.0(1) only; version 11.0(5)sr1 only
• Cisco IP Phone 8861 Firmware: version 10.3(1)es14 only; version 11.0(1) only; version 11.0(5)sr1 only
• Cisco IP Phone 8865 Firmware: version 10.3(1)es14 only; version 11.0(1) only; version 11.0(5)sr1 only

Published 2020-04-15. Last modified 2026-06-17.