Cisco Session Initiation Protocol Software up to 14.3(1)SR1 Web UI stack-based overflow

Summaryinfo

A vulnerability marked as critical has been reported in Cisco Session Initiation Protocol Software. Affected by this issue is some unknown functionality of the component Web UI. The manipulation leads to stack-based overflow. This vulnerability is listed as CVE-2025-20350. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco Session Initiation Protocol Software and classified as critical. This issue affects an unknown code of the component Web UI. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is availability. The summary by CVE is:

A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 running Cisco SIP Software could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to a buffer overflow when an affected device processes HTTP packets. An attacker could exploit this vulnerability by sending crafted HTTP input to the device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. Note: To exploit this vulnerability, the phone must be registered to Cisco Unified Communications Manager and have Web Access enabled. Web Access is disabled by default.

It is possible to read the advisory at sec.cloudapps.cisco.com. The identification of this vulnerability is CVE-2025-20350 since 10/10/2024. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/25/2025).

The vulnerability scanner Nessus provides a plugin with the ID 271389 (Cisco Desk/IP/Video Phone Denial of Service (cisco-sa-phone-dos-FPyjLV7A) (CVE-2025-20350)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (271389) and CERT Bund (WID-SEC-2025-2323). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Cisco IP Phone

Productinfo

Vendor

• Cisco

Name

• Session Initiation Protocol Software

Version

• 2.0(1)
• 2.1(1)
• 2.2(1)
• 2.3(1)
• 2.3(1)SR1
• 3.0(1)
• 3.1(1)
• 3.1(1)SR1
• 3.2(1)
• 9.3(3)
• 10.1(1)SR1
• 10.1(1)SR2
• 10.1(1.9)
• 10.2(1)
• 10.2(1)SR1
• 10.2(2)
• 10.3(1)
• 10.3(1)SR1
• 10.3(1)SR2
• 10.3(1)SR3
• 10.3(1)SR4
• 10.3(1)SR4b
• 10.3(1)SR5
• 10.3(1)SR6
• 10.3(1)SR7
• 10.3(2)
• 11-0-1MSR1-1
• 11.0(0.7) MPP
• 11.0(1)
• 11.0(2)
• 11.0(2)SR1
• 11.0(2)SR2
• 11.0(3)
• 11.0(3)SR1
• 11.0(3)SR2
• 11.0(3)SR3
• 11.0(3)SR4
• 11.0(3)SR5
• 11.0(3)SR6
• 11.0(4)
• 11.0(4)SR1
• 11.0(4)SR2
• 11.0(4)SR3
• 11.0(5)
• 11.0(5)SR1
• 11.0(5)SR2
• 11.0(5)SR3
• 11.0(6)
• 11.0(6)SR1
• 11.0(6)SR2
• 11.0(6)SR4
• 11.0(6)SR5
• 11.0(6)SR6
• 11.5(1)
• 11.5(1)SR1
• 11.7(1)
• 12.0(1)
• 12.0(1)SR1
• 12.0(1)SR2
• 12.0(1)SR3
• 12.1(1)
• 12.1(1)SR1
• 12.5(1)
• 12.5(1)SR1
• 12.5(1)SR2
• 12.5(1)SR3
• 12.6(1)
• 12.6(1)SR1
• 12.7(1)
• 12.7(1)SR1
• 12.8(1)
• 12.8(1)SR1
• 12.8(1)SR2
• 14.0(1)
• 14.0(1)SR1
• 14.0(1)SR2
• 14.0(1)SR3
• 14.1(1)
• 14.1(1)SR1
• 14.1(1)SR2
• 14.1(1)SR3
• 14.2(1)
• 14.2(1)SR1
• 14.2(1)SR2
• 14.2(1)SR3
• 14.2(1)SR4
• 14.3(1)
• 14.3(1)SR1

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion