CVE-2025-20336
Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Firmware Information Disclosure Vulnerability
Description
A vulnerability in the directory permissions of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated, remote attacker to access sensitive information on an affected device. This vulnerability exists because the product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. An attacker could exploit this vulnerability by sending a crafted packet to the IP address of a device that has Web Access enabled. A successful exploit could allow the attacker to access sensitive information from the device. Note: To exploit this vulnerability, Web Access must be enabled on the phone. Web Access is disabled by default.
Weakness: CWE-200
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Cisco SIP Software | Other Products | cna-assigner |
Vendor-reported products (1)
- Cisco · Cisco Session Initiation Protocol (SIP) Software
Vendor advisory
Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Vulnerabilities
Cisco’s rating: Medium (advisory CVSS 5.3) · Published Sep 3, 2025
Bug IDs: CSCwn51677 , CSCwn51679 , CSCwn52909 , CSCwn52910 , CSCwn52911 , CSCwn52913 , CSCwn52919 , CSCwn52920 , CSCwn52921 , CSCwn52922 , CSCwn55709 , CSCwn55710 , CSCwn55712 , CSCwn55714 , CSCwn55725 , CSCwn55726 , CSCwn55727 , CSCwn55728
The vendor’s rating applies to the whole advisory and can differ from this CVE’s own CVSS severity. Where this comes from