Vulnerability-Lookup

CVE-2026-20281 (GCVE-0-2026-20281)

Vulnerability from cvelistv5 – Published: 2026-09-02 16:14 – Updated: 2026-09-02 17:58

Title

Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability

Summary

A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that are running Cisco Session Initiation Protocol (SIP) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper memory management when an affected device processes HTTP packets. An attacker could exploit this vulnerability by sending a continuous stream of crafted HTTP packets to the device. A successful exploit could allow the attacker to cause the affected device to continuously consume memory, resulting in a DoS condition. A manual reboot of the device is required to recover from this condition. Note: For this vulnerability to be exploitable, the phone must be registered to Cisco Unified Communications Manager (Unified CM) and have Web Access enabled. Web Access is disabled by default.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-02 16:45 UTC

CWE

CWE-401 - Missing Release of Memory after Effective Lifetime

Assigner

cisco mitre root

References

1 reference

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

1 product

Vendor	Product	Version	CPE status
Cisco	Cisco Session Initiation Protocol (SIP) Software	Affected: 12.1(1)SR1 Affected: 11.5(1) Affected: 10.3(2) Affected: 10.2(2) Affected: 10.3(1) Affected: 10.3(1)SR4 Affected: 11.0(1) Affected: 10.4(1)SR2 3rd Party Affected: 11.7(1) Affected: 12.1(1) Affected: 11.0(0.7) MPP Affected: 9.3(4) 3rd Party Affected: 12.5(1)SR2 Affected: 10.2(1)SR1 Affected: 9.3(4)SR3 3rd Party Affected: 10.2(1) Affected: 12.5(1) Affected: 10.3(1)SR2 Affected: 11-0-1MSR1-1 Affected: 10.4(1) 3rd Party Affected: 12.5(1)SR1 Affected: 11.5(1)SR1 Affected: 10.1(1)SR2 Affected: 12.0(1)SR2 Affected: 12.6(1) Affected: 10.3(1.11) 3rd Party Affected: 12.0(1) Affected: 12.0(1)SR1 Affected: 9.3(3) Affected: 12.5(1)SR3 Affected: 10.3(1)SR4b Affected: 9.3(4)SR1 3rd Party Affected: 10.3(1)SR5 Affected: 10.1(1.9) Affected: 10.3(1.9) 3rd Party Affected: 9.3(4)SR2 3rd Party Affected: 10.3(1)SR1 Affected: 10.3(1)SR3 Affected: 10.1(1)SR1 Affected: 12.0(1)SR3 Affected: 12.6(1)SR1 Affected: 12.7(1) Affected: 10.3(1)SR6 Affected: 12.8(1) Affected: 12.7(1)SR1 Affected: 11.0(2)SR1 Affected: 11.0(4) Affected: 11.0(2) Affected: 11.0(4)SR3 Affected: 11.0(5) Affected: 11.0(3)SR2 Affected: 11.0(3)SR4 Affected: 11.0(3)SR3 Affected: 11.0(2)SR2 Affected: 11.0(4)SR1 Affected: 11.0(5)SR3 Affected: 11.0(3) Affected: 11.0(5)SR2 Affected: 11.0(3)SR6 Affected: 11.0(5)SR1 Affected: 11.0(4)SR2 Affected: 11.0(3)SR1 Affected: 11.0(3)SR5 Affected: 11.0(6) Affected: 12.8(1)SR1 Affected: 12.8(1)SR2 Affected: 14.0(1) Affected: 14.0(1)SR1 Affected: 11.0(6)SR1 Affected: 10.3(1)SR7 Affected: 14.0(1)SR2 Affected: 14.1(1) Affected: 14.0(1)SR3 Affected: 11.0(6)SR2 Affected: 14.1(1)SR1 Affected: 14.1(1)SR2 Affected: 11.0(6)SR4 Affected: 14.2(1) Affected: 14.2(1)SR1 Affected: 11.0(6)SR5 Affected: 14.1(1)SR3 Affected: 14.2(1)SR2 Affected: 3.1(1) Affected: 3.0(1) Affected: 2.3(1) Affected: 2.3(1)SR1 Affected: 2.2(1) Affected: 2.1(1) Affected: 2.0(1) Affected: 14.2(1)SR3 Affected: 3.1(1)SR1 Affected: 14.3(1) Affected: 3.2(1) Affected: 14.3(1)SR1 Affected: 14.2(1)SR4 Affected: 3.3(1) Affected: 11.0(6)SR6 Affected: 14.3(1)SR2 Affected: 3.4(1) Affected: 14.3(1)SR3 Affected: 3.5(1) Affected: 11.0(6)SR7 Affected: 3.5(1)SR1 Affected: 14.4(1) Affected: 3.6(1) Affected: 4.0(1) Affected: 14.4(1)SR1 Affected: 4.1(1) Affected: 14.4(1)SR2 Affected: 4.1(1)SR1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-20281",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-02T16:45:26.338821Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-02T17:58:58.216Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Session Initiation Protocol (SIP) Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "12.1(1)SR1"
            },
            {
              "status": "affected",
              "version": "11.5(1)"
            },
            {
              "status": "affected",
              "version": "10.3(2)"
            },
            {
              "status": "affected",
              "version": "10.2(2)"
            },
            {
              "status": "affected",
              "version": "10.3(1)"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR4"
            },
            {
              "status": "affected",
              "version": "11.0(1)"
            },
            {
              "status": "affected",
              "version": "10.4(1)SR2 3rd Party"
            },
            {
              "status": "affected",
              "version": "11.7(1)"
            },
            {
              "status": "affected",
              "version": "12.1(1)"
            },
            {
              "status": "affected",
              "version": "11.0(0.7) MPP"
            },
            {
              "status": "affected",
              "version": "9.3(4) 3rd Party"
            },
            {
              "status": "affected",
              "version": "12.5(1)SR2"
            },
            {
              "status": "affected",
              "version": "10.2(1)SR1"
            },
            {
              "status": "affected",
              "version": "9.3(4)SR3 3rd Party"
            },
            {
              "status": "affected",
              "version": "10.2(1)"
            },
            {
              "status": "affected",
              "version": "12.5(1)"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR2"
            },
            {
              "status": "affected",
              "version": "11-0-1MSR1-1"
            },
            {
              "status": "affected",
              "version": "10.4(1) 3rd Party"
            },
            {
              "status": "affected",
              "version": "12.5(1)SR1"
            },
            {
              "status": "affected",
              "version": "11.5(1)SR1"
            },
            {
              "status": "affected",
              "version": "10.1(1)SR2"
            },
            {
              "status": "affected",
              "version": "12.0(1)SR2"
            },
            {
              "status": "affected",
              "version": "12.6(1)"
            },
            {
              "status": "affected",
              "version": "10.3(1.11) 3rd Party"
            },
            {
              "status": "affected",
              "version": "12.0(1)"
            },
            {
              "status": "affected",
              "version": "12.0(1)SR1"
            },
            {
              "status": "affected",
              "version": "9.3(3)"
            },
            {
              "status": "affected",
              "version": "12.5(1)SR3"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR4b"
            },
            {
              "status": "affected",
              "version": "9.3(4)SR1 3rd Party"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR5"
            },
            {
              "status": "affected",
              "version": "10.1(1.9)"
            },
            {
              "status": "affected",
              "version": "10.3(1.9) 3rd Party"
            },
            {
              "status": "affected",
              "version": "9.3(4)SR2 3rd Party"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR1"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR3"
            },
            {
              "status": "affected",
              "version": "10.1(1)SR1"
            },
            {
              "status": "affected",
              "version": "12.0(1)SR3"
            },
            {
              "status": "affected",
              "version": "12.6(1)SR1"
            },
            {
              "status": "affected",
              "version": "12.7(1)"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR6"
            },
            {
              "status": "affected",
              "version": "12.8(1)"
            },
            {
              "status": "affected",
              "version": "12.7(1)SR1"
            },
            {
              "status": "affected",
              "version": "11.0(2)SR1"
            },
            {
              "status": "affected",
              "version": "11.0(4)"
            },
            {
              "status": "affected",
              "version": "11.0(2)"
            },
            {
              "status": "affected",
              "version": "11.0(4)SR3"
            },
            {
              "status": "affected",
              "version": "11.0(5)"
            },
            {
              "status": "affected",
              "version": "11.0(3)SR2"
            },
            {
              "status": "affected",
              "version": "11.0(3)SR4"
            },
            {
              "status": "affected",
              "version": "11.0(3)SR3"
            },
            {
              "status": "affected",
              "version": "11.0(2)SR2"
            },
            {
              "status": "affected",
              "version": "11.0(4)SR1"
            },
            {
              "status": "affected",
              "version": "11.0(5)SR3"
            },
            {
              "status": "affected",
              "version": "11.0(3)"
            },
            {
              "status": "affected",
              "version": "11.0(5)SR2"
            },
            {
              "status": "affected",
              "version": "11.0(3)SR6"
            },
            {
              "status": "affected",
              "version": "11.0(5)SR1"
            },
            {
              "status": "affected",
              "version": "11.0(4)SR2"
            },
            {
              "status": "affected",
              "version": "11.0(3)SR1"
            },
            {
              "status": "affected",
              "version": "11.0(3)SR5"
            },
            {
              "status": "affected",
              "version": "11.0(6)"
            },
            {
              "status": "affected",
              "version": "12.8(1)SR1"
            },
            {
              "status": "affected",
              "version": "12.8(1)SR2"
            },
            {
              "status": "affected",
              "version": "14.0(1)"
            },
            {
              "status": "affected",
              "version": "14.0(1)SR1"
            },
            {
              "status": "affected",
              "version": "11.0(6)SR1"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR7"
            },
            {
              "status": "affected",
              "version": "14.0(1)SR2"
            },
            {
              "status": "affected",
              "version": "14.1(1)"
            },
            {
              "status": "affected",
              "version": "14.0(1)SR3"
            },
            {
              "status": "affected",
              "version": "11.0(6)SR2"
            },
            {
              "status": "affected",
              "version": "14.1(1)SR1"
            },
            {
              "status": "affected",
              "version": "14.1(1)SR2"
            },
            {
              "status": "affected",
              "version": "11.0(6)SR4"
            },
            {
              "status": "affected",
              "version": "14.2(1)"
            },
            {
              "status": "affected",
              "version": "14.2(1)SR1"
            },
            {
              "status": "affected",
              "version": "11.0(6)SR5"
            },
            {
              "status": "affected",
              "version": "14.1(1)SR3"
            },
            {
              "status": "affected",
              "version": "14.2(1)SR2"
            },
            {
              "status": "affected",
              "version": "3.1(1)"
            },
            {
              "status": "affected",
              "version": "3.0(1)"
            },
            {
              "status": "affected",
              "version": "2.3(1)"
            },
            {
              "status": "affected",
              "version": "2.3(1)SR1"
            },
            {
              "status": "affected",
              "version": "2.2(1)"
            },
            {
              "status": "affected",
              "version": "2.1(1)"
            },
            {
              "status": "affected",
              "version": "2.0(1)"
            },
            {
              "status": "affected",
              "version": "14.2(1)SR3"
            },
            {
              "status": "affected",
              "version": "3.1(1)SR1"
            },
            {
              "status": "affected",
              "version": "14.3(1)"
            },
            {
              "status": "affected",
              "version": "3.2(1)"
            },
            {
              "status": "affected",
              "version": "14.3(1)SR1"
            },
            {
              "status": "affected",
              "version": "14.2(1)SR4"
            },
            {
              "status": "affected",
              "version": "3.3(1)"
            },
            {
              "status": "affected",
              "version": "11.0(6)SR6"
            },
            {
              "status": "affected",
              "version": "14.3(1)SR2"
            },
            {
              "status": "affected",
              "version": "3.4(1)"
            },
            {
              "status": "affected",
              "version": "14.3(1)SR3"
            },
            {
              "status": "affected",
              "version": "3.5(1)"
            },
            {
              "status": "affected",
              "version": "11.0(6)SR7"
            },
            {
              "status": "affected",
              "version": "3.5(1)SR1"
            },
            {
              "status": "affected",
              "version": "14.4(1)"
            },
            {
              "status": "affected",
              "version": "3.6(1)"
            },
            {
              "status": "affected",
              "version": "4.0(1)"
            },
            {
              "status": "affected",
              "version": "14.4(1)SR1"
            },
            {
              "status": "affected",
              "version": "4.1(1)"
            },
            {
              "status": "affected",
              "version": "14.4(1)SR2"
            },
            {
              "status": "affected",
              "version": "4.1(1)SR1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that are running Cisco Session Initiation Protocol (SIP) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r\n\r\nThis vulnerability is due to improper memory management when an affected device processes HTTP packets. An attacker could exploit this vulnerability by sending a continuous stream of crafted HTTP packets to the device. A successful exploit could allow the attacker to cause the affected device to continuously consume memory, resulting in a DoS condition.\u0026nbsp;A manual reboot of the device is required to recover from this condition.\r\nNote: For this vulnerability to be exploitable, the phone must be registered to Cisco Unified Communications Manager (Unified CM) and have Web Access enabled. Web Access is disabled by default."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "Missing Release of Memory after Effective Lifetime",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T16:14:26.432Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-phone-dos-txMYNRzv",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-phone-dos-txMYNRzv"
        }
      ],
      "source": {
        "advisory": "cisco-sa-phone-dos-txMYNRzv",
        "defects": [
          "CSCwu46404"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-20281",
    "datePublished": "2026-09-02T16:14:26.432Z",
    "dateReserved": "2025-10-08T11:59:15.403Z",
    "dateUpdated": "2026-09-02T17:58:58.216Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-20281",
      "date": "2026-09-03",
      "epss": "0.00332",
      "percentile": "0.25826"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-20281\",\"sourceIdentifier\":\"psirt@cisco.com\",\"published\":\"2026-09-02T17:17:33.730\",\"lastModified\":\"2026-09-02T19:23:13.660\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that are running Cisco Session Initiation Protocol (SIP) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\\r\\n\\r\\nThis vulnerability is due to improper memory management when an affected device processes HTTP packets. An attacker could exploit this vulnerability by sending a continuous stream of crafted HTTP packets to the device. A successful exploit could allow the attacker to cause the affected device to continuously consume memory, resulting in a DoS condition.\u0026nbsp;A manual reboot of the device is required to recover from this condition.\\r\\nNote: For this vulnerability to be exploitable, the phone must be registered to Cisco Unified Communications Manager (Unified CM) and have Web Access enabled. Web Access is disabled by default.\"}],\"affected\":[{\"source\":\"psirt@cisco.com\",\"affectedData\":[{\"vendor\":\"Cisco\",\"product\":\"Cisco Session Initiation Protocol (SIP) Software\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"12.1(1)SR1\",\"status\":\"affected\"},{\"version\":\"11.5(1)\",\"status\":\"affected\"},{\"version\":\"10.3(2)\",\"status\":\"affected\"},{\"version\":\"10.2(2)\",\"status\":\"affected\"},{\"version\":\"10.3(1)\",\"status\":\"affected\"},{\"version\":\"10.3(1)SR4\",\"status\":\"affected\"},{\"version\":\"11.0(1)\",\"status\":\"affected\"},{\"version\":\"10.4(1)SR2 3rd Party\",\"status\":\"affected\"},{\"version\":\"11.7(1)\",\"status\":\"affected\"},{\"version\":\"12.1(1)\",\"status\":\"affected\"},{\"version\":\"11.0(0.7) MPP\",\"status\":\"affected\"},{\"version\":\"9.3(4) 3rd Party\",\"status\":\"affected\"},{\"version\":\"12.5(1)SR2\",\"status\":\"affected\"},{\"version\":\"10.2(1)SR1\",\"status\":\"affected\"},{\"version\":\"9.3(4)SR3 3rd Party\",\"status\":\"affected\"},{\"version\":\"10.2(1)\",\"status\":\"affected\"},{\"version\":\"12.5(1)\",\"status\":\"affected\"},{\"version\":\"10.3(1)SR2\",\"status\":\"affected\"},{\"version\":\"11-0-1MSR1-1\",\"status\":\"affected\"},{\"version\":\"10.4(1) 3rd Party\",\"status\":\"affected\"},{\"version\":\"12.5(1)SR1\",\"status\":\"affected\"},{\"version\":\"11.5(1)SR1\",\"status\":\"affected\"},{\"version\":\"10.1(1)SR2\",\"status\":\"affected\"},{\"version\":\"12.0(1)SR2\",\"status\":\"affected\"},{\"version\":\"12.6(1)\",\"status\":\"affected\"},{\"version\":\"10.3(1.11) 3rd Party\",\"status\":\"affected\"},{\"version\":\"12.0(1)\",\"status\":\"affected\"},{\"version\":\"12.0(1)SR1\",\"status\":\"affected\"},{\"version\":\"9.3(3)\",\"status\":\"affected\"},{\"version\":\"12.5(1)SR3\",\"status\":\"affected\"},{\"version\":\"10.3(1)SR4b\",\"status\":\"affected\"},{\"version\":\"9.3(4)SR1 3rd Party\",\"status\":\"affected\"},{\"version\":\"10.3(1)SR5\",\"status\":\"affected\"},{\"version\":\"10.1(1.9)\",\"status\":\"affected\"},{\"version\":\"10.3(1.9) 3rd Party\",\"status\":\"affected\"},{\"version\":\"9.3(4)SR2 3rd Party\",\"status\":\"affected\"},{\"version\":\"10.3(1)SR1\",\"status\":\"affected\"},{\"version\":\"10.3(1)SR3\",\"status\":\"affected\"},{\"version\":\"10.1(1)SR1\",\"status\":\"affected\"},{\"version\":\"12.0(1)SR3\",\"status\":\"affected\"},{\"version\":\"12.6(1)SR1\",\"status\":\"affected\"},{\"version\":\"12.7(1)\",\"status\":\"affected\"},{\"version\":\"10.3(1)SR6\",\"status\":\"affected\"},{\"version\":\"12.8(1)\",\"status\":\"affected\"},{\"version\":\"12.7(1)SR1\",\"status\":\"affected\"},{\"version\":\"11.0(2)SR1\",\"status\":\"affected\"},{\"version\":\"11.0(4)\",\"status\":\"affected\"},{\"version\":\"11.0(2)\",\"status\":\"affected\"},{\"version\":\"11.0(4)SR3\",\"status\":\"affected\"},{\"version\":\"11.0(5)\",\"status\":\"affected\"},{\"version\":\"11.0(3)SR2\",\"status\":\"affected\"},{\"version\":\"11.0(3)SR4\",\"status\":\"affected\"},{\"version\":\"11.0(3)SR3\",\"status\":\"affected\"},{\"version\":\"11.0(2)SR2\",\"status\":\"affected\"},{\"version\":\"11.0(4)SR1\",\"status\":\"affected\"},{\"version\":\"11.0(5)SR3\",\"status\":\"affected\"},{\"version\":\"11.0(3)\",\"status\":\"affected\"},{\"version\":\"11.0(5)SR2\",\"status\":\"affected\"},{\"version\":\"11.0(3)SR6\",\"status\":\"affected\"},{\"version\":\"11.0(5)SR1\",\"status\":\"affected\"},{\"version\":\"11.0(4)SR2\",\"status\":\"affected\"},{\"version\":\"11.0(3)SR1\",\"status\":\"affected\"},{\"version\":\"11.0(3)SR5\",\"status\":\"affected\"},{\"version\":\"11.0(6)\",\"status\":\"affected\"},{\"version\":\"12.8(1)SR1\",\"status\":\"affected\"},{\"version\":\"12.8(1)SR2\",\"status\":\"affected\"},{\"version\":\"14.0(1)\",\"status\":\"affected\"},{\"version\":\"14.0(1)SR1\",\"status\":\"affected\"},{\"version\":\"11.0(6)SR1\",\"status\":\"affected\"},{\"version\":\"10.3(1)SR7\",\"status\":\"affected\"},{\"version\":\"14.0(1)SR2\",\"status\":\"affected\"},{\"version\":\"14.1(1)\",\"status\":\"affected\"},{\"version\":\"14.0(1)SR3\",\"status\":\"affected\"},{\"version\":\"11.0(6)SR2\",\"status\":\"affected\"},{\"version\":\"14.1(1)SR1\",\"status\":\"affected\"},{\"version\":\"14.1(1)SR2\",\"status\":\"affected\"},{\"version\":\"11.0(6)SR4\",\"status\":\"affected\"},{\"version\":\"14.2(1)\",\"status\":\"affected\"},{\"version\":\"14.2(1)SR1\",\"status\":\"affected\"},{\"version\":\"11.0(6)SR5\",\"status\":\"affected\"},{\"version\":\"14.1(1)SR3\",\"status\":\"affected\"},{\"version\":\"14.2(1)SR2\",\"status\":\"affected\"},{\"version\":\"3.1(1)\",\"status\":\"affected\"},{\"version\":\"3.0(1)\",\"status\":\"affected\"},{\"version\":\"2.3(1)\",\"status\":\"affected\"},{\"version\":\"2.3(1)SR1\",\"status\":\"affected\"},{\"version\":\"2.2(1)\",\"status\":\"affected\"},{\"version\":\"2.1(1)\",\"status\":\"affected\"},{\"version\":\"2.0(1)\",\"status\":\"affected\"},{\"version\":\"14.2(1)SR3\",\"status\":\"affected\"},{\"version\":\"3.1(1)SR1\",\"status\":\"affected\"},{\"version\":\"14.3(1)\",\"status\":\"affected\"},{\"version\":\"3.2(1)\",\"status\":\"affected\"},{\"version\":\"14.3(1)SR1\",\"status\":\"affected\"},{\"version\":\"14.2(1)SR4\",\"status\":\"affected\"},{\"version\":\"3.3(1)\",\"status\":\"affected\"},{\"version\":\"11.0(6)SR6\",\"status\":\"affected\"},{\"version\":\"14.3(1)SR2\",\"status\":\"affected\"},{\"version\":\"3.4(1)\",\"status\":\"affected\"},{\"version\":\"14.3(1)SR3\",\"status\":\"affected\"},{\"version\":\"3.5(1)\",\"status\":\"affected\"},{\"version\":\"11.0(6)SR7\",\"status\":\"affected\"},{\"version\":\"3.5(1)SR1\",\"status\":\"affected\"},{\"version\":\"14.4(1)\",\"status\":\"affected\"},{\"version\":\"3.6(1)\",\"status\":\"affected\"},{\"version\":\"4.0(1)\",\"status\":\"affected\"},{\"version\":\"14.4(1)SR1\",\"status\":\"affected\"},{\"version\":\"4.1(1)\",\"status\":\"affected\"},{\"version\":\"14.4(1)SR2\",\"status\":\"affected\"},{\"version\":\"4.1(1)SR1\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-02T16:45:26.338821Z\",\"id\":\"CVE-2026-20281\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"references\":[{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-phone-dos-txMYNRzv\",\"source\":\"psirt@cisco.com\"}]}}"
  }
}

CERTFR-2026-AVI-1110

Vulnerability from certfr_avis - Published: 2026-09-03 - Updated: 2026-09-03

De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Cisco	IP Phone	SIP Software versions antérieures à 5.0(1) pour Desk Phone 9800 Series et Video Phone 8875
Cisco	IOS XR	IOS XR Software Train versions 24.2.x antérieures à 24.2.2 et 24.2.21 et sans le dernier correctif de sécurité
Cisco	IOS XR	IOS XR Software Train versions 24.4.x antérieures à 24.4.2 et sans le dernier correctif de sécurité
Cisco	IOS XR	IOS XR Software Train versions 24.3.x antérieures à 24.3.2 et sans le dernier correctif de sécurité
Cisco	IOS XR	IOS XR Software Train versions 7.11.x antérieures à 7.11.2 et 7.11.21 et sans le dernier correctif de sécurité
Cisco	IOS XR	IOS XR Software Train versions 24.1.x antérieures à 24.1.2 et sans le dernier correctif de sécurité
Cisco	IOS XR	IOS XR Software Train versions 26.3.x antérieures à 26.3.1
Cisco	IOS XR	IOS XR Software Train versions 26.1.x antérieures à 26.1.2 et sans le dernier correctif de sécurité
Cisco	IOS XR	IOS XR Software Train versions 25.2.x antérieures à 25.2.21 et 25.2.2 et sans le dernier correctif de sécurité
Cisco	IOS XR	IOS XR Software Train versions 25.1.x antérieures à 25.1.2 et sans le dernier correctif de sécurité
Cisco	IOS XR	IOS XR Software Train versions 7.10.x antérieures à 7.10.2 et sans le dernier correctif de sécurité
Cisco	IOS XR	IOS XR Software Train versions 7.9.x antérieures à 7.9.2 et 7.9.21 et sans le dernier correctif de sécurité
Cisco	IOS XR	IOS XR Software Train versions 6.9.x antérieures à 6.9.2 et sans le dernier correctif de sécurité
Cisco	IP Phone	SIP Software versions 14.4.x et antérieures à 14.4(1)SR3 pour IP Phone 7800 and 8800 Series
Cisco	IOS XR	IOS XR Software Train versions 25.4.x antérieures à 25.4.1 et 25.4.2 et sans le dernier correctif de sécurité
Cisco	IP Phone	SIP Software versions 11.0.x et antérieures à 11.0(6)SR8 pour Wireless IP Phone 8821
Cisco	IOS XR	IOS XR Software Train versions 26.2.x antérieures à 26.2.1 et 26.2.2 et sans le dernier correctif de sécurité
Cisco	IP Phone	SIP Software versions 14.4.x et antérieures à 14.4(1)SR4 pour IP Phone 8845 and 8865
Cisco	IOS XR	IOS XR Software Train versions 7.3.x antérieures à 7.3.2 et sans le dernier correctif de sécurité
Cisco	N/A	Cisco Nexus 9000 Series Switches avec Silicon One ASIC sans le dernier correctif de sécurité

References

Title

Publication Time

FKIE_CVE-2026-20281

Vulnerability from fkie_nvd - Published: 2026-09-02 17:17 - Updated: 2026-09-02 19:23

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	psirt@cisco.com	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-phone-dos-txMYNRzv

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Session Initiation Protocol (SIP) Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "12.1(1)SR1"
            },
            {
              "status": "affected",
              "version": "11.5(1)"
            },
            {
              "status": "affected",
              "version": "10.3(2)"
            },
            {
              "status": "affected",
              "version": "10.2(2)"
            },
            {
              "status": "affected",
              "version": "10.3(1)"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR4"
            },
            {
              "status": "affected",
              "version": "11.0(1)"
            },
            {
              "status": "affected",
              "version": "10.4(1)SR2 3rd Party"
            },
            {
              "status": "affected",
              "version": "11.7(1)"
            },
            {
              "status": "affected",
              "version": "12.1(1)"
            },
            {
              "status": "affected",
              "version": "11.0(0.7) MPP"
            },
            {
              "status": "affected",
              "version": "9.3(4) 3rd Party"
            },
            {
              "status": "affected",
              "version": "12.5(1)SR2"
            },
            {
              "status": "affected",
              "version": "10.2(1)SR1"
            },
            {
              "status": "affected",
              "version": "9.3(4)SR3 3rd Party"
            },
            {
              "status": "affected",
              "version": "10.2(1)"
            },
            {
              "status": "affected",
              "version": "12.5(1)"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR2"
            },
            {
              "status": "affected",
              "version": "11-0-1MSR1-1"
            },
            {
              "status": "affected",
              "version": "10.4(1) 3rd Party"
            },
            {
              "status": "affected",
              "version": "12.5(1)SR1"
            },
            {
              "status": "affected",
              "version": "11.5(1)SR1"
            },
            {
              "status": "affected",
              "version": "10.1(1)SR2"
            },
            {
              "status": "affected",
              "version": "12.0(1)SR2"
            },
            {
              "status": "affected",
              "version": "12.6(1)"
            },
            {
              "status": "affected",
              "version": "10.3(1.11) 3rd Party"
            },
            {
              "status": "affected",
              "version": "12.0(1)"
            },
            {
              "status": "affected",
              "version": "12.0(1)SR1"
            },
            {
              "status": "affected",
              "version": "9.3(3)"
            },
            {
              "status": "affected",
              "version": "12.5(1)SR3"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR4b"
            },
            {
              "status": "affected",
              "version": "9.3(4)SR1 3rd Party"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR5"
            },
            {
              "status": "affected",
              "version": "10.1(1.9)"
            },
            {
              "status": "affected",
              "version": "10.3(1.9) 3rd Party"
            },
            {
              "status": "affected",
              "version": "9.3(4)SR2 3rd Party"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR1"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR3"
            },
            {
              "status": "affected",
              "version": "10.1(1)SR1"
            },
            {
              "status": "affected",
              "version": "12.0(1)SR3"
            },
            {
              "status": "affected",
              "version": "12.6(1)SR1"
            },
            {
              "status": "affected",
              "version": "12.7(1)"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR6"
            },
            {
              "status": "affected",
              "version": "12.8(1)"
            },
            {
              "status": "affected",
              "version": "12.7(1)SR1"
            },
            {
              "status": "affected",
              "version": "11.0(2)SR1"
            },
            {
              "status": "affected",
              "version": "11.0(4)"
            },
            {
              "status": "affected",
              "version": "11.0(2)"
            },
            {
              "status": "affected",
              "version": "11.0(4)SR3"
            },
            {
              "status": "affected",
              "version": "11.0(5)"
            },
            {
              "status": "affected",
              "version": "11.0(3)SR2"
            },
            {
              "status": "affected",
              "version": "11.0(3)SR4"
            },
            {
              "status": "affected",
              "version": "11.0(3)SR3"
            },
            {
              "status": "affected",
              "version": "11.0(2)SR2"
            },
            {
              "status": "affected",
              "version": "11.0(4)SR1"
            },
            {
              "status": "affected",
              "version": "11.0(5)SR3"
            },
            {
              "status": "affected",
              "version": "11.0(3)"
            },
            {
              "status": "affected",
              "version": "11.0(5)SR2"
            },
            {
              "status": "affected",
              "version": "11.0(3)SR6"
            },
            {
              "status": "affected",
              "version": "11.0(5)SR1"
            },
            {
              "status": "affected",
              "version": "11.0(4)SR2"
            },
            {
              "status": "affected",
              "version": "11.0(3)SR1"
            },
            {
              "status": "affected",
              "version": "11.0(3)SR5"
            },
            {
              "status": "affected",
              "version": "11.0(6)"
            },
            {
              "status": "affected",
              "version": "12.8(1)SR1"
            },
            {
              "status": "affected",
              "version": "12.8(1)SR2"
            },
            {
              "status": "affected",
              "version": "14.0(1)"
            },
            {
              "status": "affected",
              "version": "14.0(1)SR1"
            },
            {
              "status": "affected",
              "version": "11.0(6)SR1"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR7"
            },
            {
              "status": "affected",
              "version": "14.0(1)SR2"
            },
            {
              "status": "affected",
              "version": "14.1(1)"
            },
            {
              "status": "affected",
              "version": "14.0(1)SR3"
            },
            {
              "status": "affected",
              "version": "11.0(6)SR2"
            },
            {
              "status": "affected",
              "version": "14.1(1)SR1"
            },
            {
              "status": "affected",
              "version": "14.1(1)SR2"
            },
            {
              "status": "affected",
              "version": "11.0(6)SR4"
            },
            {
              "status": "affected",
              "version": "14.2(1)"
            },
            {
              "status": "affected",
              "version": "14.2(1)SR1"
            },
            {
              "status": "affected",
              "version": "11.0(6)SR5"
            },
            {
              "status": "affected",
              "version": "14.1(1)SR3"
            },
            {
              "status": "affected",
              "version": "14.2(1)SR2"
            },
            {
              "status": "affected",
              "version": "3.1(1)"
            },
            {
              "status": "affected",
              "version": "3.0(1)"
            },
            {
              "status": "affected",
              "version": "2.3(1)"
            },
            {
              "status": "affected",
              "version": "2.3(1)SR1"
            },
            {
              "status": "affected",
              "version": "2.2(1)"
            },
            {
              "status": "affected",
              "version": "2.1(1)"
            },
            {
              "status": "affected",
              "version": "2.0(1)"
            },
            {
              "status": "affected",
              "version": "14.2(1)SR3"
            },
            {
              "status": "affected",
              "version": "3.1(1)SR1"
            },
            {
              "status": "affected",
              "version": "14.3(1)"
            },
            {
              "status": "affected",
              "version": "3.2(1)"
            },
            {
              "status": "affected",
              "version": "14.3(1)SR1"
            },
            {
              "status": "affected",
              "version": "14.2(1)SR4"
            },
            {
              "status": "affected",
              "version": "3.3(1)"
            },
            {
              "status": "affected",
              "version": "11.0(6)SR6"
            },
            {
              "status": "affected",
              "version": "14.3(1)SR2"
            },
            {
              "status": "affected",
              "version": "3.4(1)"
            },
            {
              "status": "affected",
              "version": "14.3(1)SR3"
            },
            {
              "status": "affected",
              "version": "3.5(1)"
            },
            {
              "status": "affected",
              "version": "11.0(6)SR7"
            },
            {
              "status": "affected",
              "version": "3.5(1)SR1"
            },
            {
              "status": "affected",
              "version": "14.4(1)"
            },
            {
              "status": "affected",
              "version": "3.6(1)"
            },
            {
              "status": "affected",
              "version": "4.0(1)"
            },
            {
              "status": "affected",
              "version": "14.4(1)SR1"
            },
            {
              "status": "affected",
              "version": "4.1(1)"
            },
            {
              "status": "affected",
              "version": "14.4(1)SR2"
            },
            {
              "status": "affected",
              "version": "4.1(1)SR1"
            }
          ]
        }
      ],
      "source": "psirt@cisco.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that are running Cisco Session Initiation Protocol (SIP) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r\n\r\nThis vulnerability is due to improper memory management when an affected device processes HTTP packets. An attacker could exploit this vulnerability by sending a continuous stream of crafted HTTP packets to the device. A successful exploit could allow the attacker to cause the affected device to continuously consume memory, resulting in a DoS condition.\u0026nbsp;A manual reboot of the device is required to recover from this condition.\r\nNote: For this vulnerability to be exploitable, the phone must be registered to Cisco Unified Communications Manager (Unified CM) and have Web Access enabled. Web Access is disabled by default."
    }
  ],
  "id": "CVE-2026-20281",
  "lastModified": "2026-09-02T19:23:13.660",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "psirt@cisco.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-20281",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-02T16:45:26.338821Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-02T17:17:33.730",
  "references": [
    {
      "source": "psirt@cisco.com",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-phone-dos-txMYNRzv"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-401"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Secondary"
    }
  ]
}

GHSA-998P-WVFV-584P

Vulnerability from github – Published: 2026-09-02 18:32 – Updated: 2026-09-02 18:32

Details

This vulnerability is due to improper memory management when an affected device processes HTTP packets. An attacker could exploit this vulnerability by sending a continuous stream of crafted HTTP packets to the device. A successful exploit could allow the attacker to cause the affected device to continuously consume memory, resulting in a DoS condition. A manual reboot of the device is required to recover from this condition. Note: For this vulnerability to be exploitable, the phone must be registered to Cisco Unified Communications Manager (Unified CM) and have Web Access enabled. Web Access is disabled by default.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-20281"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-02T17:17:33Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that are running Cisco Session Initiation Protocol (SIP) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\n\nThis vulnerability is due to improper memory management when an affected device processes HTTP packets. An attacker could exploit this vulnerability by sending a continuous stream of crafted HTTP packets to the device. A successful exploit could allow the attacker to cause the affected device to continuously consume memory, resulting in a DoS condition.\u0026nbsp;A manual reboot of the device is required to recover from this condition.\nNote: For this vulnerability to be exploitable, the phone must be registered to Cisco Unified Communications Manager (Unified CM) and have Web Access enabled. Web Access is disabled by default.",
  "id": "GHSA-998p-wvfv-584p",
  "modified": "2026-09-02T18:32:27Z",
  "published": "2026-09-02T18:32:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20281"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-phone-dos-txMYNRzv"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-20281 (GCVE-0-2026-20281)

CERTFR-2026-AVI-1110

Solutions

FKIE_CVE-2026-20281

GHSA-998P-WVFV-584P

Tags

Sightings

Nomenclature