# CVE-2020-3161: Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability

Source: https://junglewise.ai/threats/cve-2020-3161-cisco-ip-phones-web-server-remote-code-execution-and-denial-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-11-03. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2020-3161 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2021-11-03

A vulnerability in the web server of Cisco IP Phones due to improper input validation of HTTP requests allows unauthenticated remote attackers to execute code with root privileges or cause a denial-of-service (DoS) condition via crafted HTTP requests.

Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2020-3161 exploited in the wild?** Yes. CVE-2020-3161 is known to be exploited in the wild, first recorded on 3 November 2021. Treat it as urgent.

**How severe is CVE-2020-3161?** Critical severity, with a CVSS score of 9.8, published 3 November 2021.

**Which products and versions are affected?** Cisco IP Phone 7811 Firmware 11.0(1); Cisco IP Phone 7821 Firmware 11.0(1); Cisco IP Phone 7841 Firmware 11.0(1); Cisco IP Phone 7861 Firmware 11.0(1); and 6 more.

**Is there a fix for CVE-2020-3161?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2020-3161 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2020-3161?** Check whether you run Cisco Ip Phones. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Cisco IP Phone 7811 Firmware 11.0(1)
- Cisco IP Phone 7821 Firmware 11.0(1)
- Cisco IP Phone 7841 Firmware 11.0(1)
- Cisco IP Phone 7861 Firmware 11.0(1)
- Cisco IP Phone 8811 Firmware 10.3(1)es14, 11.0(1), 11.0(5)sr1
- Cisco IP Phone 8821 Firmware 10.3(1)es14, 11.0(1), 11.0(5)sr1
- Cisco IP Phone 8841 Firmware 10.3(1)es14, 11.0(1), 11.0(5)sr1
- Cisco IP Phone 8845 Firmware 10.3(1)es14, 11.0(1), 11.0(5)sr1
- Cisco IP Phone 8851 Firmware 10.3(1)es14, 11.0(1), 11.0(5)sr1
- Cisco 8831 Firmware 10.3(1)es14, 11.0(1), 11.0(5)sr1

## Timeline

- 2020-04-28: disclosed: Initial analysis by NIST
- 2021-11-03: kev added: Added to CISA Known Exploited Vulnerabilities Catalog