CVE-2023-20079

—

CVSS 3.1

7.5 high

EPSS

10%p95

Published

Mar 3, 2023 (Mar 3, 2023)

Modified

Jun 17, 2026

Description

Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory.

Vendors: cisco
Products: ip phone 6871 firmware, ip phone 6861 firmware, ip phone 6851 firmware, ip phone 6841 firmware, ip phone 6825 firmware, ip phone 7861 firmware, ip phone 7841 firmware, ip phone 7832 firmware, ip phone 7821 firmware, ip phone 7811 firmware, ip phone 8865 firmware, ip phone 8861 firmware
Weakness: CWE-121, CWE-787
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (10.3%)

In the news2 stories

Cisco fixed a critical command injection bug in IP Phone Series

Security AffairsMar 2, 15:55 UTC · Mar 2, 2023Vulnerability in the wildCVE-2023-20078 CVE-2023-20079

Critical Flaw in Cisco IP Phone Series Exposes Users to Command Injection Attack

The Hacker NewsMar 2, 04:17 UTC · Mar 2, 2023Vulnerability in the wildCVE-2023-20078 CVE-2023-20079 CVE-2023-22747+1 CVEs