cisco-sa-phone-dos-txMYNRzvHighCVSS 7.5

Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability

Published
September 2, 2026
Last Modified
September 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-20281 →

📋 Description

A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that are running Cisco Session Initiation Protocol (SIP) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

This vulnerability is due to improper memory management when an affected device processes HTTP packets. An attacker could exploit this vulnerability by sending a continuous stream of crafted HTTP packets to the device. A successful exploit could allow the attacker to cause the affected device to continuously consume memory, resulting in a DoS condition. A manual reboot of the device is required to recover from this condition.

Note: For this vulnerability to be exploitable, the phone must be registered to Cisco Unified Communications Manager (Unified CM) and have Web Access enabled. Web Access is disabled by default.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

CVE-2026-20281 — Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability (CVSS 3.1 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

🎯 Affected products111

  • Cisco Session Initiation Protocol (SIP) Software
  • Cisco Session Initiation Protocol (SIP) Software 10.1(1)SR1
  • Cisco Session Initiation Protocol (SIP) Software 10.1(1)SR2
  • Cisco Session Initiation Protocol (SIP) Software 10.1(1.9)
  • Cisco Session Initiation Protocol (SIP) Software 10.2(1)
  • Cisco Session Initiation Protocol (SIP) Software 10.2(1)SR1
  • Cisco Session Initiation Protocol (SIP) Software 10.2(2)
  • Cisco Session Initiation Protocol (SIP) Software 10.3(1)
  • Cisco Session Initiation Protocol (SIP) Software 10.3(1)SR1
  • Cisco Session Initiation Protocol (SIP) Software 10.3(1)SR2
  • Cisco Session Initiation Protocol (SIP) Software 10.3(1)SR3
  • Cisco Session Initiation Protocol (SIP) Software 10.3(1)SR4
  • Cisco Session Initiation Protocol (SIP) Software 10.3(1)SR4b
  • Cisco Session Initiation Protocol (SIP) Software 10.3(1)SR5
  • Cisco Session Initiation Protocol (SIP) Software 10.3(1)SR6
  • Cisco Session Initiation Protocol (SIP) Software 10.3(1)SR7
  • Cisco Session Initiation Protocol (SIP) Software 10.3(1.11) 3rd Party
  • Cisco Session Initiation Protocol (SIP) Software 10.3(1.9) 3rd Party
  • Cisco Session Initiation Protocol (SIP) Software 10.3(2)
  • Cisco Session Initiation Protocol (SIP) Software 10.4(1) 3rd Party
  • Cisco Session Initiation Protocol (SIP) Software 10.4(1)SR2 3rd Party
  • Cisco Session Initiation Protocol (SIP) Software 11-0-1MSR1-1
  • Cisco Session Initiation Protocol (SIP) Software 11.0(0.7) MPP
  • Cisco Session Initiation Protocol (SIP) Software 11.0(1)
  • Cisco Session Initiation Protocol (SIP) Software 11.0(2)
  • Cisco Session Initiation Protocol (SIP) Software 11.0(2)SR1
  • Cisco Session Initiation Protocol (SIP) Software 11.0(2)SR2
  • Cisco Session Initiation Protocol (SIP) Software 11.0(3)
  • Cisco Session Initiation Protocol (SIP) Software 11.0(3)SR1
  • Cisco Session Initiation Protocol (SIP) Software 11.0(3)SR2
  • +81 more not shown

✅ Remediation

Cisco has released software updates that address this vulnerability. https://software.cisco.com Workarounds: There are no workarounds that address this vulnerability. However, disabling Web Access mitigates this vulnerability. To disable Web Access on a specific device, follow these steps: Log in to the Unified CM to which the phone is registered using administrative privileges, which allow modification of devices. Choose Device > Phone. Enter the search criteria in the search box and click Find. Choose the appropriate device from the Device Name list. Under Web Access, use the toggle button to choose Disabled. Click Save. To verify that Web Access has been disabled, enter the IP address of the phone into a browser window on a device that has internet access, and click Enter. If the IP address is unreachable, Web Access has been disabled. To disable Web Access on multiple devices, use the Bulk Admin Tool (BAT) as detailed in the Bulk Administration Guide for Cisco Unified Communications Manager ["https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/bat/14SU1/cucm_b_bulk-administration-guide-14SU1/cucm_b_bulk-administration-guide-1251su2_chapter_01.html"]. While this mitigation has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

🔗 References (3)