Cisco Desk, IP, and Video Phones Vulnerable to Remote DoS and XSS Attacks

Multiple Cisco desk, IP, and video phones are vulnerable to remote DoS and XSS attacks through flaws in their SIP software, according to Cisco. The weaknesses affect Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 when registered to Cisco Unified Communications Manager with Web Access enabled; there are no workarounds, and devices must be upgraded to the fixed SIP software versions.

Cisco released Advisory ID cisco-sa-phone-dos-FPyjLV7A on 15 October 2025, detailing two distinct vulnerabilities: an unauthenticated attacker can send specially crafted HTTP packets to trigger a buffer overflow and cause a DoS, and an attacker can inject malicious scripts via unsanitised input to perform an XSS attack on the device’s web interface. Both flaws require Web Access to be active, though it is disabled by default in some configurations.

The advisory lists CVE-2025-20350 for Remote DoS and CVE-2025-20351 for XSS, with CVSS base scores of 7.5 and 6.1 respectively, and notes that Multiplatform Firmware is not affected. Administrators should verify Web Access status and apply patches promptly, as delays increase exposure and risk.