CVE-2025-20351: Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Firmware Cross-Site Scripting Vulnerability

Q: What is the severity of CVE-2025-20351?

CVE-2025-20351 is classified as a high severity vulnerability due to the potential for unauthenticated remote attackers to conduct XSS attacks.

Q: How do I fix CVE-2025-20351?

To fix CVE-2025-20351, update the affected Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 to the latest available firmware as provided by Cisco.

Q: What are the affected products for CVE-2025-20351?

The affected products for CVE-2025-20351 include the Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 Series, Cisco IP Phone 8800 Series, and Cisco Video Phone 8875.

Q: Can CVE-2025-20351 be exploited remotely?

Yes, CVE-2025-20351 can be exploited remotely by an unauthenticated attacker through the web UI.

Q: What type of attacks can occur due to CVE-2025-20351?

CVE-2025-20351 can allow attackers to conduct Cross-Site Scripting (XSS) attacks against users of the web UI.

Published Oct 15, 2025

Updated

A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 running Cisco SIP Software could allow an unauthenticated, remote attacker to conduct XSS attacks against a user of the web UI. This vulnerability exists because the web UI of an affected device does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Note: To exploit this vulnerability, the phone must be registered to Cisco Unified Communications Manager and have Web Access enabled. Web Access is disabled by default.

Affected Software

89 affected components

Cisco Desk Phone 9800 Series

Cisco IP Phone 7800 Series

Cisco IP Phone 8800 Series

Cisco Video Phone 8875

All of the following

Cisco Desk Phone 9871 Firmware>=3.0\(1\)<=3.2\(1\)

Cisco Desk Phone 9871

All of the following

Cisco Desk Phone 9841 Firmware>=3.0\(1\)<=3.2\(1\)

Cisco Desk Phone 9841

All of the following

Cisco Desk Phone 9851 Firmware>=3.0\(1\)<=3.2\(1\)

Cisco Desk Phone 9851

All of the following

Cisco Desk Phone 9861 Firmware>=3.0\(1\)<=3.2\(1\)

Cisco Desk Phone 9861

All of the following

Any of the following

Cisco Ip Phone 8865 Firmware<14.3\(1\)

Cisco Ip Phone 8865 Firmware=14.3\(1\)

Cisco Ip Phone 8865 Firmware=14.3\(1\)-sr1

Cisco Ip Phone 8865

All of the following

Any of the following

Cisco Ip Phone 7811 Firmware<14.3\(1\)

Cisco Ip Phone 7811 Firmware=14.3\(1\)

Cisco Ip Phone 7811 Firmware=14.3\(1\)-sr1

Cisco Ip Phone 7811

All of the following

Any of the following

Cisco Ip Phone 7821 Firmware<14.3\(1\)

Cisco Ip Phone 7821 Firmware=14.3\(1\)

Cisco Ip Phone 7821 Firmware=14.3\(1\)-sr1

Cisco Ip Phone 7821

All of the following

Any of the following

Cisco Ip Phone 7841 Firmware<14.3\(1\)

Cisco Ip Phone 7841 Firmware=14.3\(1\)

Cisco Ip Phone 7841 Firmware=14.3\(1\)-sr1

Cisco Ip Phone 7841

All of the following

Any of the following

Cisco Ip Phone 7861 Firmware<14.3\(1\)

Cisco Ip Phone 7861 Firmware=14.3\(1\)

Cisco Ip Phone 7861 Firmware=14.3\(1\)-sr1

Cisco IP Phone 7861

All of the following

Any of the following

Cisco Ip Phone 8811 Firmware<14.3\(1\)

Cisco Ip Phone 8811 Firmware=14.3\(1\)

Cisco Ip Phone 8811 Firmware=14.3\(1\)-sr1

Cisco Ip Phone 8811

All of the following

Any of the following

Cisco Ip Phone 8832 Firmware<14.3\(1\)

Cisco Ip Phone 8832 Firmware=14.3\(1\)

Cisco Ip Phone 8832 Firmware=14.3\(1\)-sr1

Cisco Ip Phone 8832

All of the following

Any of the following

Cisco Ip Phone 8841 Firmware<14.3\(1\)

Cisco Ip Phone 8841 Firmware=14.3\(1\)

Cisco Ip Phone 8841 Firmware=14.3\(1\)-sr1

Cisco Ip Phone 8841

All of the following

Any of the following

Cisco Ip Phone 8845 Firmware<14.3\(1\)

Cisco Ip Phone 8845 Firmware=14.3\(1\)

Cisco Ip Phone 8845 Firmware=14.3\(1\)-sr1

Cisco Ip Phone 8845

All of the following

Any of the following

Cisco Ip Phone 8851 Firmware<14.3\(1\)

Cisco Ip Phone 8851 Firmware=14.3\(1\)

Cisco Ip Phone 8851 Firmware=14.3\(1\)-sr1

Cisco IP Phone 8851

All of the following

Any of the following

Cisco Ip Phone 8861 Firmware<14.3\(1\)

Cisco Ip Phone 8861 Firmware=14.3\(1\)

Cisco Ip Phone 8861 Firmware=14.3\(1\)-sr1

Cisco Ip Phone 8861

All of the following

Any of the following

Cisco Ip Phone 8821 Firmware<11.0\(1\)

Cisco Ip Phone 8821 Firmware=11.0\(0.7\)-mpp

Cisco Ip Phone 8821 Firmware=11.0\(1\)

Cisco Ip Phone 8821 Firmware=11.0\(2\)

Cisco Ip Phone 8821 Firmware=11.0\(2\)-sr1

Cisco Ip Phone 8821 Firmware=11.0\(2\)-sr2

Cisco Ip Phone 8821 Firmware=11.0\(3\)

Cisco Ip Phone 8821 Firmware=11.0\(3\)-sr1

Cisco Ip Phone 8821 Firmware=11.0\(3\)-sr2

Cisco Ip Phone 8821 Firmware=11.0\(3\)-sr3

Cisco Ip Phone 8821 Firmware=11.0\(3\)-sr4

Cisco Ip Phone 8821 Firmware=11.0\(3\)-sr5

Cisco Ip Phone 8821 Firmware=11.0\(3\)-sr6

Cisco Ip Phone 8821 Firmware=11.0\(4\)

Cisco Ip Phone 8821 Firmware=11.0\(4\)-sr1

Cisco Ip Phone 8821 Firmware=11.0\(4\)-sr2

Cisco Ip Phone 8821 Firmware=11.0\(4\)-sr3

Cisco Ip Phone 8821 Firmware=11.0\(5\)

Cisco Ip Phone 8821 Firmware=11.0\(5\)-sr1

Cisco Ip Phone 8821 Firmware=11.0\(5\)-sr2

Cisco Ip Phone 8821 Firmware=11.0\(5\)-sr3

Cisco Ip Phone 8821 Firmware=11.0\(6\)

Cisco Ip Phone 8821 Firmware=11.0\(6\)-sr1

Cisco Ip Phone 8821 Firmware=11.0\(6\)-sr2

Cisco Ip Phone 8821 Firmware=11.0\(6\)-sr4

Cisco Ip Phone 8821 Firmware=11.0\(6\)-sr5

Cisco Ip Phone 8821 Firmware=11.0\(6\)-sr6

Cisco IP Phone 8821

All of the following

Any of the following

Cisco Video Phone 8875 Firmware<2.3\(1\)

Cisco Video Phone 8875 Firmware>=3.0\(1\)<=3.2\(1\)

Cisco Video Phone 8875 Firmware=2.3\(1\)

Cisco Video Phone 8875 Firmware=2.3\(1\)-sr1

Cisco Video Phone 8875

Event History

Oct 15, 2025

CVE Published

via MITRE·04:15 PM

Data Sourced

via MITRE·04:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-20351?

CVE-2025-20351 is classified as a high severity vulnerability due to the potential for unauthenticated remote attackers to conduct XSS attacks.

How do I fix CVE-2025-20351?

To fix CVE-2025-20351, update the affected Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 to the latest available firmware as provided by Cisco.

What are the affected products for CVE-2025-20351?

The affected products for CVE-2025-20351 include the Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 Series, Cisco IP Phone 8800 Series, and Cisco Video Phone 8875.

Can CVE-2025-20351 be exploited remotely?

Yes, CVE-2025-20351 can be exploited remotely by an unauthenticated attacker through the web UI.

What type of attacks can occur due to CVE-2025-20351?

CVE-2025-20351 can allow attackers to conduct Cross-Site Scripting (XSS) attacks against users of the web UI.

CVE-2025-20351: Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Firmware Cross-Site Scripting Vulnerability

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2025-20351?

How do I fix CVE-2025-20351?

What are the affected products for CVE-2025-20351?

Can CVE-2025-20351 be exploited remotely?

What type of attacks can occur due to CVE-2025-20351?

Company

Resources

Contact