CVE-2020-3161
Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability
Description
CVE-2020-3161 is a CRITICAL severity remote code execution and denial-of-service vulnerability in the web server of Cisco IP Phones, classified under CWE-20 (Improper Input Validation). The vulnerability stems from a lack of proper input validation of HTTP requests processed by the phone's built-in web server. An unauthenticated, remote attacker can send a crafted HTTP request to execute code with root privileges or cause a device reload. With a CVSS 3.1 score of 9.8 and an EPSS score of 0.83148 (99.25th percentile), this vulnerability presents an extreme exploitation risk. CISA added it to the KEV catalog on November 3, 2021. Multiple Cisco IP Phone models are affected, including the 7800 and 8800 series.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | ip phone 8865 firmware | 10.3\(1\)es14; 11.0\(1\); 11.0\(5\)sr1 |
| cisco | ip phone 8851 firmware | 10.3\(1\)es14; 11.0\(1\); 11.0\(5\)sr1 |
| cisco | ip phone 7841 firmware | 11.0\(1\) |
| cisco | ip phone 7821 firmware | 11.0\(1\) |
| cisco | ip phone 8811 firmware | 10.3\(1\)es14; 11.0\(1\); 11.0\(5\)sr1 |
| cisco | ip phone 8861 firmware | 10.3\(1\)es14; 11.0\(1\); 11.0\(5\)sr1 |
| cisco | ip phone 8845 firmware | 10.3\(1\)es14; 11.0\(1\); 11.0\(5\)sr1 |
| cisco | ip phone 7861 firmware | 11.0\(1\) |
| cisco | ip phone 8841 firmware | 10.3\(1\)es14; 11.0\(1\); 11.0\(5\)sr1 |
| cisco | ip phone 7811 firmware | 11.0\(1\) |
| cisco | ip phone 8821 firmware | 10.3\(1\)es14; 11.0\(1\); 11.0\(5\)sr1 |
| cisco | ip phone 8821-ex firmware | 10.3\(1\)es14; 11.0\(1\); 11.0\(5\)sr1 |
| cisco | 8831 firmware | 10.3\(1\)es14; 11.0\(1\); 11.0\(5\)sr1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/157265/Cisco-IP-Phone-11.7-Denial-Of-Service.html(Exploit, Third Party Advisory, VDB Entry)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voip-phones-rce-dos-rB6EeRXs(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3161(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
Improper Input Validation occurs when a product receives input or data but does not validate or incorrectly validates that the input has the properties required to process the data safely and correctly. Web servers are particularly susceptible to this weakness because they must parse complex HTTP request structures including headers, URI paths, query parameters, and request bodies. When validation is insufficient, attackers can craft requests that trigger buffer overflows, format string vulnerabilities, or other memory corruption issues.
In the context of CVE-2020-3161, the web server embedded in Cisco IP Phones does not properly validate the content of incoming HTTP requests. The phones expose a web server for configuration and management purposes that listens on the network. When this web server receives a specially crafted HTTP request with malicious input in specific request fields, the insufficient validation allows the input to overflow internal buffers or corrupt memory structures. Since the web server process runs with root privileges on the phone's operating system, successful exploitation grants the attacker full control over the device, including the ability to execute arbitrary commands, intercept voice traffic, or render the phone inoperable.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2020-3161 carries a CVSS 3.1 base score of 9.8 (CRITICAL) with network-exploitable attack characteristics requiring no authentication or user interaction.
Confidentiality (High): Root-level code execution on a Cisco IP Phone provides complete access to the device's configuration, stored credentials, call history, voicemail recordings, and any data processed by the phone. The attacker can intercept active voice calls, enable the phone's microphone for room surveillance, and access the phone's network configuration including VLAN assignments and 802.1X credentials used for network authentication.
Integrity (High): With root access, an attacker can modify the phone's firmware, configuration, and behavior. This includes altering call routing to redirect calls, modifying the phone's display to show false information for social engineering attacks, installing persistent backdoors, and changing the phone's network configuration to pivot into voice VLANs or management networks.
Availability (High): The vulnerability can directly cause a device reload, disrupting phone service for the affected endpoint. An attacker can persistently crash phones across an organization, causing a complete telephony outage. In emergency environments such as hospitals or public safety agencies, loss of phone service can have life-threatening consequences.
Scope (Unchanged): While the CVSS scope is unchanged, compromised IP Phones sit on voice VLANs that are often less secured than data VLANs. A compromised phone can serve as a pivot point for lateral movement into voice infrastructure, call management servers, and other telephony components.
Exploit Maturity
Active Exploitation: CVE-2020-3161 is actively exploited in the wild. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog on November 3, 2021, with a remediation deadline of May 3, 2022 for federal agencies.
Public Exploit: A public exploit for this vulnerability is available on Packet Storm Security as Cisco IP Phone 11.7 Denial Of Service. The availability of public exploit code significantly lowers the barrier for exploitation.
High EPSS Score: The EPSS score of 0.83148 (99.25th percentile) places this vulnerability in the top 0.75% of all CVEs for exploitation probability. This extremely high score reflects the combination of public exploit availability, confirmed active exploitation, and the ease of sending crafted HTTP requests to vulnerable devices.
Large Attack Surface: Cisco IP Phones are ubiquitous in enterprise environments, with millions of devices deployed worldwide. The web server is enabled by default on many models and is often accessible from the data VLAN, expanding the attack surface beyond the voice network.
IoT/Phone Patching Challenges: IP Phones are notoriously difficult to patch due to their large deployment numbers, the need for coordinated firmware upgrades through CUCM, and the operational impact of phone reboots during business hours.
Remediation
-
Apply Cisco firmware updates immediately. Install the patched firmware versions as described in Cisco Security Advisory cisco-sa-voip-phones-rce-dos-rB6EeRXs. Use Cisco Unified Communications Manager (CUCM) for centralized firmware deployment across all affected phones.
-
Disable the web server on IP Phones if not needed. If the phone's web interface is not required for management, disable it through CUCM's Phone Security Profile settings or device-level configuration. This completely eliminates the attack vector.
-
Restrict network access to the phone web server. Implement access control lists on network switches to limit which source IP addresses can reach the phone's HTTP/HTTPS ports. Only permit access from authorized management stations.
-
Enforce voice VLAN segmentation. Ensure that IP Phones are on dedicated voice VLANs that are properly isolated from data VLANs and external networks. Use 802.1Q VLAN tagging and switch port configurations to prevent unauthorized access to the voice network.
-
Monitor for exploitation indicators. Look for unusual HTTP traffic patterns directed at IP Phone addresses, particularly requests with oversized headers or malformed URI paths. Unexpected phone reboots may indicate exploitation attempts.
-
Implement network-based intrusion prevention. Deploy IPS signatures capable of detecting crafted HTTP requests targeting Cisco IP Phone web servers. Position IPS sensors on network segments where phones are deployed.
Technical Details
CVE-2020-3161 is a remote code execution and denial-of-service vulnerability in the embedded web server of Cisco IP Phones. The web server provides a management interface for phone configuration, diagnostics, and status monitoring. It runs as a privileged process with root-level access on the phone's operating system.
The vulnerability exists because the web server does not properly validate HTTP request input before processing it. When the phone receives a crafted HTTP request with specific malicious content, the lack of input validation leads to a buffer overflow or memory corruption condition. The web server process does not implement adequate bounds checking on request fields such as the URI path, headers, or query parameters.
The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates a network-based attack with low complexity that requires no authentication or user interaction and impacts all three CIA components at the highest level. An attacker only needs network access to the phone's IP address and the ability to send HTTP requests.
Multiple Cisco IP Phone models are affected across the 7800 and 8800 series, including the IP Phone 7821, 7841, 8811, 8851, 8861, and 8865. Affected firmware versions include 10.3(1)ES14, 11.0(1), and 11.0(5)SR1. The vulnerability is present in both the HTTP and HTTPS services, so restricting to HTTPS alone does not mitigate the issue.
The public exploit demonstrates the denial-of-service aspect by sending a crafted request that causes the phone to crash and reload. The remote code execution aspect leverages the same memory corruption to redirect execution flow and gain root shell access on the phone's embedded Linux operating system.
Frequently Asked Questions
Is CVE-2020-3161 being actively exploited?
Yes, CVE-2020-3161 is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2021. A public exploit is available on Packet Storm Security, and the EPSS score of 0.83148 (99.25th percentile) confirms extremely high exploitation activity. The ease of exploitation via simple HTTP requests makes this vulnerability accessible to a wide range of attackers.
What products are affected by CVE-2020-3161?
CVE-2020-3161 affects multiple Cisco IP Phone models in the 7800 and 8800 series, including the IP Phone 7821, 7841, 8811, 8851, 8861, and 8865. Affected firmware versions include 10.3(1)ES14, 11.0(1), and 11.0(5)SR1. Any IP Phone with the web server enabled and accessible over the network is vulnerable.
How do I fix CVE-2020-3161?
Apply the firmware update from Cisco through the Unified Communications Manager. As an immediate mitigation, disable the web server on IP Phones through the Phone Security Profile in CUCM if the web interface is not required. Restrict network access to phone web server ports using access control lists and ensure proper voice VLAN segmentation.
How severe is CVE-2020-3161?
CVE-2020-3161 is rated CRITICAL with a CVSS score of 9.8. It allows unauthenticated remote code execution with root privileges on IP Phones, enabling call interception, room surveillance via the microphone, and lateral movement into voice infrastructure. The large number of deployed Cisco IP Phones and the difficulty of patching phone firmware make this a particularly challenging vulnerability to remediate across enterprise environments.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.