CVE Feed

    Dashboard / CVE / CVE-2025-20351

    CVE-2025-20351

    A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 running Cisco SIP Software could allow an unauthenticated, remote attacker to conduct XSS attacks against a user of the web UI. This vulnerability exists because the web UI of an affected device does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Note: To exploit this vulnerability, the phone must be registered to Cisco Unified Communications Manager and have Web Access enabled. Web Access is disabled by default.

    Published:Oct 15, 2025
    Last Modified:Dec 4, 2025
    EPS:Oct 15, 2025
    EPSS Score:0.00047
    CVSS Score:6.1

    Affected Products

    Vendor
    Cisco
    Product
    Desk Phone 9841
    Vendor
    Cisco
    Product
    Desk Phone 9841 Firmware
    Vendor
    Cisco
    Product
    Desk Phone 9851
    Vendor
    Cisco
    Product
    Desk Phone 9851 Firmware
    Vendor
    Cisco
    Product
    Desk Phone 9861
    Vendor
    Cisco
    Product
    Desk Phone 9861 Firmware
    Vendor
    Cisco
    Product
    Desk Phone 9871
    Vendor
    Cisco
    Product
    Desk Phone 9871 Firmware
    Vendor
    Cisco
    Product
    Ip Phone 7800
    Vendor
    Cisco
    Product
    Ip Phone 7811
    Vendor
    Cisco
    Product
    Ip Phone 7811 Firmware
    Vendor
    Cisco
    Product
    Ip Phone 7821
    Vendor
    Cisco
    Product
    Ip Phone 7821 Firmware
    Vendor
    Cisco
    Product
    Ip Phone 7841
    Vendor
    Cisco
    Product
    Ip Phone 7841 Firmware
    Vendor
    Cisco
    Product
    Ip Phone 7861
    Vendor
    Cisco
    Product
    Ip Phone 7861 Firmware
    Vendor
    Cisco
    Product
    Ip Phone 8800
    Vendor
    Cisco
    Product
    Ip Phone 8800 Series
    Vendor
    Cisco
    Product
    Ip Phone 8811
    Vendor
    Cisco
    Product
    Ip Phone 8811 Firmware
    Vendor
    Cisco
    Product
    Ip Phone 8821
    Vendor
    Cisco
    Product
    Ip Phone 8821 Firmware
    Vendor
    Cisco
    Product
    Ip Phone 8832
    Vendor
    Cisco
    Product
    Ip Phone 8832 Firmware
    Vendor
    Cisco
    Product
    Ip Phone 8841
    Vendor
    Cisco
    Product
    Ip Phone 8841 Firmware
    Vendor
    Cisco
    Product
    Ip Phone 8845
    Vendor
    Cisco
    Product
    Ip Phone 8845 Firmware
    Vendor
    Cisco
    Product
    Ip Phone 8851
    Vendor
    Cisco
    Product
    Ip Phone 8851 Firmware
    Vendor
    Cisco
    Product
    Ip Phone 8861
    Vendor
    Cisco
    Product
    Ip Phone 8861 Firmware
    Vendor
    Cisco
    Product
    Ip Phone 8865
    Vendor
    Cisco
    Product
    Ip Phone 8865 Firmware
    Vendor
    Cisco
    Product
    Session Initiation Protocol (sip) Firmware
    Vendor
    Cisco
    Product
    Video Phone 8875
    Vendor
    Cisco
    Product
    Video Phone 8875 Firmware

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-20350 (CVSS 7.5) — A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco …
    CVE-2025-20335 (CVSS 5.3) — A vulnerability in the directory permissions of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Ser…
    CVE-2025-20336 (CVSS 5.3) — A vulnerability in the directory permissions of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Ser…
    CVE-2025-20158 (CVSS 4.4) — A vulnerability in the debug shell of Cisco Video Phone 8875 and Cisco Desk Phone 9800 Series could allow an a…
    CVE-2024-20534 (CVSS 4.8) — A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 6800, 7800, and 8800 Series, and…
    CVE-2024-20533 (CVSS 4.8) — A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 6800, 7800, and 8800 Series, and…
    CVE-2024-20445 (CVSS 5.3) — A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High