Actively exploited · Published Apr 15, 2020 · Assigned by cisco
CVE-2020-3161Cisco IP Phones Web Server Remote Code Execution and Denial of Service Vulnerability
Critical 9.8 Exploited
In plain English
A critical-severity improper input validation in Cisco IP phone from Cisco. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 83.9% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web server of a targeted device. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a DoS condition.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco IP phone | n/a |
Weakness: CWE-20 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- 20200415 Cisco IP Phones Web Server Remote Code Execution and Denial of Service Vulnerability vendor-advisory, x_refsource_CISCO
- http://packetstormsecurity.com/files/157265/Cisco-IP-Phone-11.7-Denial-Of-Service.html x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3161 government-resource