Summary

• A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that are running Cisco Session Initiation Protocol (SIP) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

  This vulnerability is due to improper memory management when an affected device processes HTTP packets. An attacker could exploit this vulnerability by sending a continuous stream of crafted HTTP packets to the device. A successful exploit could allow the attacker to cause the affected device to continuously consume memory, resulting in a DoS condition. A manual reboot of the device is required to recover from this condition.

  Note: For this vulnerability to be exploitable, the phone must be registered to Cisco Unified Communications Manager (Unified CM) and have Web Access enabled. Web Access is disabled by default.

  Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

  This advisory is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-phone-dos-txMYNRzv

Affected Products

• Vulnerable Products

  This vulnerability affects the following Cisco products if they are running a vulnerable release of Cisco SIP Software, are registered to Cisco Unified CM, and have Web Access enabled:

  • Desk Phone 9800 Series
  • IP Phone 7800 Series
  • IP Phone 8800 Series
  • Video Phone 8875

  The Web Access feature is disabled by default.

  For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.

  Determine Whether Web Access Is Enabled

  To determine whether Web Access is enabled, use the following steps:

  1. Press the gear icon on the front of the phone to access the Settings menu.
  2. Choose Admin settings > Network Setup > Ethernet setup or Wi-Fi client setup > IPv4 setup. See the IP address for the phone.
  3. On a device that has access to the internet, open a web browser and enter the IP address in the address bar. Press Enter.

  If the Device Information screen appears in the web browser, then Web Access is enabled on the phone.

  Products Confirmed Not Vulnerable

  Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.

  Cisco has confirmed that these vulnerabilities do not affect Cisco IP Phone 7800 Series or 8800 Series that are running Cisco Multiplatform Firmware.

Workarounds

• There are no workarounds that address this vulnerability. However, disabling Web Access mitigates this vulnerability.

  To disable Web Access on a specific device, follow these steps:

  1. Log in to the Unified CM to which the phone is registered using administrative privileges, which allow modification of devices.
  2. Choose Device > Phone.
  3. Enter the search criteria in the search box and click Find.
  4. Choose the appropriate device from the Device Name list.
  5. Under Web Access, use the toggle button to choose Disabled.
  6. Click Save.

  To verify that Web Access has been disabled, enter the IP address of the phone into a browser window on a device that has internet access, and click Enter. If the IP address is unreachable, Web Access has been disabled.

  To disable Web Access on multiple devices, use the Bulk Admin Tool (BAT) as detailed in the Bulk Administration Guide for Cisco Unified Communications Manager.

  While this mitigation has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

Fixed Software

• Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To fully remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.

  Fixed Releases

  In the following tables, the left column lists Cisco software releases. The right column indicates whether a release is affected by the vulnerability that is described in this advisory and the first release that includes the fix for this vulnerability. Customers are advised to upgrade to an appropriate fixed software release as indicated in this section.

  Desk Phone 9800 Series and Video Phone 8875

  Cisco SIP Software Release	First Fixed Release
  4.1(1)SR1 and earlier	Migrate to a fixed release.
  5	5.0(1)

  IP Phone 7800 and 8800 Series

  Cisco SIP Software Release	First Fixed Release
  Earlier than 14.4	Migrate to a fixed release.
  14.4	14.4(1)SR3

  IP Phone 8845 and 8865

  Cisco SIP Software Release	First Fixed Release
  Earlier than 14.4	Migrate to a fixed release.
  14.4	14.4(1)SR4

  Wireless IP Phone 8821

  Cisco SIP Software Release	First Fixed Release
  Earlier than 11.0	Migrate to a fixed release.
  11.0	11.0(6)SR8

  The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.

Exploitation and Public Announcements

• The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

Source

• Cisco would like to thank Bertie Hallows for reporting this vulnerability.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-phone-dos-txMYNRzv

Revision History

• Version	Description	Section	Status	Date
  1.0	Initial public release.	—	Final	2026-SEP-02

  Show Less

---