Cisco Patches High-Severity CVE-2025-20350 DoS Flaw in Desk and IP Phones

Cisco has released security updates to patch two vulnerabilities affecting multiple Cisco Desk Phone and IP Phone models, including the 9800, 7800, 8800, and 8875 series, which could allow unauthenticated remote attackers to cause a denial-of-service or, in the case of CVE-2025-20351, execute arbitrary JavaScript in the victim’s browser.

CVE-2025-20350 carries a CVSS base score of 7.5 (High) and stems from a buffer overflow triggered when the device processes HTTP input on the web interface of Cisco SIP Software; Cisco explained that an attacker could exploit this by sending crafted HTTP input to the device, potentially causing it to reload and produce a DoS condition.

According to Cisco, Web Access must be enabled and the device registered to Cisco Unified Communications Manager for the flaw to be exploitable, and Web Access is disabled by default in many deployments. The second flaw, CVE-2025-20351, is rated Medium with a CVSS score of 6.1 and involves insufficient input validation within the web interface, potentially allowing attackers to execute arbitrary JavaScript code in the victim’s browser.

The affected products running vulnerable releases and with Web Access enabled include Desk Phone 9800 Series, IP Phone 7800/8800 Series, and Video Phone 8875, with fixed releases listed as Desk Phone 9800 Series: SIP Software 3.3(1); IP Phone 7800/8800 Series: SIP Software 14.3(1)SR2 and 14.4(1); IP Phone 8821: SIP Software 11.0(6)SR7; and Video Phone 8875: SIP Software 3.3(1).