CVE-2020-3161
Estado: AnalizadaCrítica (9.8)⚠ Explotación activa
A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web server of a targeted device. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a DoS condition.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 9.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 84%
- Percentil entre todas las CVEs puntuadas: 100
- Fecha de la puntuación: 1/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
CISA KEV — explotada activamente
- Añadida al catálogo: 3/11/2021
- Plazo de remediación: 3/5/2022
- Uso conocido en ransomware: Unknown
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1190Exploit Public-Facing Applicationinitial access95 % - Impacto principal
T1059Command and Scripting Interpreterexecution90 % - Impacto secundario
T1499.004Application or System Exploitationimpact85 %
Vulnerabilidad en servidor web de teléfonos Cisco explotable remotamente sin autenticación (AV:N/PR:N) mediante solicitud HTTP malformada. Permite ejecución remota de código con privilegios root (T1059) o recarga del dispositivo (DoS/T1499.004).
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (13)
Cisco — 8831 FirmwareCisco — IP Phone 7811 FirmwareCisco — IP Phone 7821 FirmwareCisco — IP Phone 7841 FirmwareCisco — IP Phone 7861 FirmwareCisco — IP Phone 8811 FirmwareCisco — IP Phone 8821-ex FirmwareCisco — IP Phone 8821 FirmwareCisco — IP Phone 8841 FirmwareCisco — IP Phone 8845 FirmwareCisco — IP Phone 8851 FirmwareCisco — IP Phone 8861 FirmwareCisco — IP Phone 8865 Firmware
CWE
- CWE-20
- CWE-20
Referencias
- http://packetstormsecurity.com/files/157265/Cisco-IP-Phone-11.7-Denial-Of-Service.html
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voip-phones-rce-dos-rB6EeRXs
- http://packetstormsecurity.com/files/157265/Cisco-IP-Phone-11.7-Denial-Of-Service.html
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voip-phones-rce-dos-rB6EeRXs
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3161
JSON original (NVD)
Mostrar
{
"id": "CVE-2020-3161",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2020-3161",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "active"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-11-08T16:11:11.668072Z"
}
}
],
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 10,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "psirt@cisco.com",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco IP phone",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2020-04-15T20:15:15.097",
"references": [
{
"url": "http://packetstormsecurity.com/files/157265/Cisco-IP-Phone-11.7-Denial-Of-Service.html",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"source": "psirt@cisco.com"
},
{
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voip-phones-rce-dos-rB6EeRXs",
"tags": [
"Vendor Advisory"
],
"source": "psirt@cisco.com"
},
{
"url": "http://packetstormsecurity.com/files/157265/Cisco-IP-Phone-11.7-Denial-Of-Service.html",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voip-phones-rce-dos-rB6EeRXs",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3161",
"tags": [
"US Government Resource"
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"description": [
{
"lang": "en",
"value": "CWE-20"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-20"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web server of a targeted device. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a DoS condition."
},
{
"lang": "es",
"value": "Una vulnerabilidad en el servidor web de Cisco IP Phones, podría permitir a un atacante no autenticado remoto ejecutar código con privilegios root o causar una recarga de un teléfono IP afectado, resultando en una condición de denegación de servicio (DoS). La vulnerabilidad es debido a una falta de comprobación de entrada apropiada de las peticiones HTTP. Un atacante podría explotar esta vulnerabilidad mediante el envío de una petición HTTP diseñada al servidor web de un dispositivo apuntado. Una explotación con éxito podría permitir a un atacante ejecutar código remotamente con privilegios root o causar una recarga de un teléfono IP afectado, resultando en una condición DoS."
}
],
"lastModified": "2026-06-17T03:17:31.293",
"cisaActionDue": "2022-05-03",
"cisaExploitAdd": "2021-11-03",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8865_firmware:10.3\\(1\\)es14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F84C7842-0D6A-4950-AC9B-63602140BAF1"
},
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8865_firmware:11.0\\(1\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "144FA4D4-61A7-454F-9373-F91548E4B8AE"
},
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8865_firmware:11.0\\(5\\)sr1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "85C8430D-496C-44CA-AA95-6448F3459373"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:ip_phone_8865:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BB99B9AB-64B5-4989-9579-A1BB5D2D87EF"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8851_firmware:10.3\\(1\\)es14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5800EBC5-4C54-46E9-B742-A49EE6D57A32"
},
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8851_firmware:11.0\\(1\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BB5548D1-7E70-4E75-B0FC-FC390B858612"
},
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8851_firmware:11.0\\(5\\)sr1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "07844DC0-2E7A-4540-897D-C4E2B440C4EB"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:ip_phone_8851:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8AF6DC5E-F582-445E-BF05-2D55A0954663"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ip_phone_7841_firmware:11.0\\(1\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1617D281-505F-49D2-AAAB-91D61F7D4797"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:ip_phone_7841:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "73CF8A50-11BD-4506-BF2A-CCA36BF59EFF"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ip_phone_7821_firmware:11.0\\(1\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B552853A-14E0-4339-A87E-7AE00BF143EA"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:ip_phone_7821:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "AE7AFFF0-5B21-400B-B923-E9B7FCCE08FA"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8811_firmware:10.3\\(1\\)es14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8260121F-1819-40ED-A3CC-86A98B84CF13"
},
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8811_firmware:11.0\\(1\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2404681B-34F2-4F60-AE8B-1A41E2FCFB68"
},
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8811_firmware:11.0\\(5\\)sr1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D7BDE345-B411-4A8B-A6A6-A031C52E2844"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:ip_phone_8811:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D0CC3127-3152-4906-9FE0-BC6F21DCADAA"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8861_firmware:10.3\\(1\\)es14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D1350005-A1E5-4794-B853-9DB3494C3B78"
},
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8861_firmware:11.0\\(1\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F5E2CDC1-4031-4F88-94C2-4AA7AC112D87"
},
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8861_firmware:11.0\\(5\\)sr1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "228ADA90-87B0-4BBF-A7CB-ABDC2509E5A7"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:ip_phone_8861:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "090EE553-01D5-45F0-87A4-E1167F46EB77"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8845_firmware:10.3\\(1\\)es14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "363E47B4-E22B-4A8A-92CD-1ACDB2CF6CD5"
},
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8845_firmware:11.0\\(1\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B41E93DB-62E6-4AFB-8C72-44C51E1CB1E7"
},
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8845_firmware:11.0\\(5\\)sr1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "16218F2F-0889-437D-A8C4-EFC7C197C19A"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:ip_phone_8845:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A313E64A-F43C-4FBA-A389-6171CBD709C0"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ip_phone_7861_firmware:11.0\\(1\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5E2460C9-F9C8-4436-BD8E-3FDD8978E8C8"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:ip_phone_7861:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E52C420C-FD54-4BE4-8720-E05307D53520"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8841_firmware:10.3\\(1\\)es14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B73D3CF0-E2A3-4A76-82D8-3C899B41BA11"
},
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8841_firmware:11.0\\(1\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E719FD30-98C0-4582-8ED5-DDBA01CCC055"
},
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8841_firmware:11.0\\(5\\)sr1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6528A512-7359-4F95-9BD4-0083524F9125"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:ip_phone_8841:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7944CC9C-AE08-4F30-AF65-134DADBD0FA1"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ip_phone_7811_firmware:11.0\\(1\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6D715BDD-D977-4581-BA09-A2936991CFA7"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:ip_phone_7811:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D7260C17-7067-47AD-995F-366A5E8B10E7"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8821_firmware:10.3\\(1\\)es14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AA6858D1-20BC-417A-9328-196798A23B48"
},
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8821_firmware:11.0\\(1\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9E4622EF-D5CA-4971-A3A7-0610C136F160"
},
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8821_firmware:11.0\\(5\\)sr1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2740B39B-ADD1-4CD9-BEF8-FFBDEA1567F0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:ip_phone_8821:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "36C99E0B-0383-4CB3-B325-EC0F3D57D39D"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8821-ex_firmware:10.3\\(1\\)es14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A3783AE8-6B80-4DC4-8525-84E63D50DAAC"
},
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8821-ex_firmware:11.0\\(1\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FFC9FAB0-B9A7-476A-AAF0-A4B14FC48CF2"
},
{
"criteria": "cpe:2.3:o:cisco:ip_phone_8821-ex_firmware:11.0\\(5\\)sr1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E6745422-3CE4-41A0-A87E-BD9C5DA45BF2"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:ip_phone_8821-ex:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "EE56B858-B59D-4197-9B2A-33A03908B967"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:8831_firmware:10.3\\(1\\)es14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9F731586-5715-45FA-AB4D-7301D15DFB60"
},
{
"criteria": "cpe:2.3:o:cisco:8831_firmware:11.0\\(1\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "188DB874-2611-4919-A2E0-A955852AB424"
},
{
"criteria": "cpe:2.3:o:cisco:8831_firmware:11.0\\(5\\)sr1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DAD76AAB-7FD9-4F31-87C2-899128A1943E"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:8831:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BE2514A1-486C-40F7-8746-56E2B973CBE6"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "psirt@cisco.com",
"cisaRequiredAction": "Apply updates per vendor instructions.",
"cisaVulnerabilityName": "Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability"
}