CVE-2020-3161

🗓️ 15 Apr 2020 20:10:11Reported by ciscoType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 1078 Views🌐 WEB

"Cisco IP Phones web server vulnerability allows remote code execution or DoS

Reporter	Title	Published	Views	Family All 20
0day.today	Cisco IP Phone 11.7 - Denial of service Vulnerability	18 Apr 202000:00	–	zdt
ATTACKERKB	CVE-2020-3161	15 Apr 202000:00	–	attackerkb
BDU FSTEC	The vulnerability of the configuration for connecting microprogramming software-based Cisco IP phones to web servers allows a perpetrator to execute arbitrary code or cause a service failure.	29 May 202000:00	–	bdu_fstec
Circl	CVE-2020-3161	8 Nov 202108:58	–	circl
CISA KEV Catalog	Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability	3 Nov 202100:00	–	cisa_kev
Cisco	Cisco IP Phones Web Server Remote Code Execution and Denial of Service Vulnerability	15 Apr 202016:00	–	cisco
Tenable Nessus	Cisco IP Phones Web Server RCE and DOS (cisco-sa-voip-phones-rce-dos-rB6EeRXs)	6 Oct 202000:00	–	nessus
Tenable Nessus	Cisco IP Phones Web Server Remote Code Execution and Denial of Service (CVE-2020-3161)	18 Mar 202400:00	–	nessus
CNVD	Input Validation Error Vulnerability in Multiple Cisco Products (CNVD-2020-31998)	16 Apr 202000:00	–	cnvd
Check Point Advisories	Cisco IP Phone Denial of Service (CVE-2020-3161)	21 May 202000:00	–	checkpoint_advisories

NVD

Node

AND

cisco ip_phone_8865_firmwareMatch10.3(1)es14

cisco ip_phone_8865_firmwareMatch11.0(1)

cisco ip_phone_8865_firmwareMatch11.0(5)sr1

cisco ip_phone_8865Match-

Node

AND

cisco ip_phone_8851_firmwareMatch10.3(1)es14

cisco ip_phone_8851_firmwareMatch11.0(1)

cisco ip_phone_8851_firmwareMatch11.0(5)sr1

cisco ip_phone_8851Match-

Node

AND

cisco ip_phone_7841_firmwareMatch11.0(1)

cisco ip_phone_7841Match-

Node

AND

cisco ip_phone_7821_firmwareMatch11.0(1)

cisco ip_phone_7821Match-

Node

AND

cisco ip_phone_8811_firmwareMatch10.3(1)es14

cisco ip_phone_8811_firmwareMatch11.0(1)

cisco ip_phone_8811_firmwareMatch11.0(5)sr1

cisco ip_phone_8811Match-

Node

AND

cisco ip_phone_8861_firmwareMatch10.3(1)es14

cisco ip_phone_8861_firmwareMatch11.0(1)

cisco ip_phone_8861_firmwareMatch11.0(5)sr1

cisco ip_phone_8861Match-

Node

AND

cisco ip_phone_8845_firmwareMatch10.3(1)es14

cisco ip_phone_8845_firmwareMatch11.0(1)

cisco ip_phone_8845_firmwareMatch11.0(5)sr1

cisco ip_phone_8845Match-

Node

AND

cisco ip_phone_7861_firmwareMatch11.0(1)

cisco ip_phone_7861Match-

Node

AND

cisco ip_phone_8841_firmwareMatch10.3(1)es14

cisco ip_phone_8841_firmwareMatch11.0(1)

cisco ip_phone_8841_firmwareMatch11.0(5)sr1

cisco ip_phone_8841Match-

Node

AND

cisco ip_phone_7811_firmwareMatch11.0(1)

cisco ip_phone_7811Match-

Node

AND

cisco ip_phone_8821_firmwareMatch10.3(1)es14

cisco ip_phone_8821_firmwareMatch11.0(1)

cisco ip_phone_8821_firmwareMatch11.0(5)sr1

cisco ip_phone_8821Match-

Node

AND

cisco ip_phone_8821-ex_firmwareMatch10.3(1)es14

cisco ip_phone_8821-ex_firmwareMatch11.0(1)

cisco ip_phone_8821-ex_firmwareMatch11.0(5)sr1

cisco ip_phone_8821-exMatch-

Node

AND

cisco 8831_firmwareMatch10.3(1)es14

cisco 8831_firmwareMatch11.0(1)

cisco 8831_firmwareMatch11.0(5)sr1

cisco 8831Match-

[
  {
    "product": "Cisco IP phone",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/157265/Cisco-IP-Phone-11.7-Denial-Of-Service.html
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voip-phones-rce-dos-rB6EeRXs
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
params	query param	deviceconfig/setActivationCode	Unauthenticated crafted HTTP request to /deviceconfig/setActivationCode allows exploitation due to improper input validation, enabling remote code execution or DoS.	CWE-20

17 Jun 2026 03:17Current

9.5High risk

Vulners AI Score9.5

CVSS 3.19.8

CVSS 210

CVSS 39.8

EPSS0.83734

SSVC

cisco ip phones web server vulnerability remote code execution dos cve-2020-3161 nvd