CVE-2025-20335
Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Firmware Information Arbitrary File Write Vulnerability
Description
A vulnerability in the directory permissions of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated, remote attacker to write arbitrary files on an affected device. This vulnerability is due to a lack of proper authentication controls. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to perform arbitrary file writes to specific directories in the underlying operating system. Note: To exploit this vulnerability, Web Access must be enabled on the phone. Web Access is disabled by default.
Weakness: CWE-284
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Cisco SIP Software | Other Products | cna-assigner |
Vendor-reported products (1)
- Cisco · Cisco Session Initiation Protocol (SIP) Software
Vendor advisory
Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Vulnerabilities
Cisco’s rating: Medium (advisory CVSS 5.3) · Published Sep 3, 2025
Bug IDs: CSCwn51677 , CSCwn51679 , CSCwn52909 , CSCwn52910 , CSCwn52911 , CSCwn52913 , CSCwn52919 , CSCwn52920 , CSCwn52921 , CSCwn52922 , CSCwn55709 , CSCwn55710 , CSCwn55712 , CSCwn55714 , CSCwn55725 , CSCwn55726 , CSCwn55727 , CSCwn55728
The vendor’s rating applies to the whole advisory and can differ from this CVE’s own CVSS severity. Where this comes from