Security Advisory

CVE-2023-20078: Cisco IP Phone 6800, 7800 and 8800 Series Web UI Root-Privilege Command Injection

Last updated:
  • CVE-2023-20078

CVE-2023-20078 is a critical, unauthenticated command-injection vulnerability (CWE-787, out-of-bounds write) in the web-based management interface of Cisco's IP Phone 6800, 7800 and 8800 Series desk phones and conferencing endpoints when running Multiplatform Firmware: a remote attacker who can reach the phone's web UI, with no credentials or user interaction required, can inject arbitrary commands that execute with root privileges on the device; NVD has published its own Primary CVSS v3.1 score of 9.1 (critical), and Cisco rates the same flaw 9.8 (critical) in its own advisory.

Vulnerability summary

9.1

Critical

10.4%

EPSS score (FIRST)

No

CISA KEV catalog

2023-03-03

Published

Vulnerability ID: CVE-2023-20078 · Source: NVD

Affected components

ComponentCPEVersion range
Cisco IP Phone 6800, 7800 and 8800 Series desk phones and conferencing endpoints running Multiplatform Firmware (MPP)—Multiplatform Firmware prior to 11.3.7SR1; NVD's CPE configuration data lists 17 distinct vulnerable firmware identifiers across the IP Phone 6825, 6841, 6851, 6861, 6871, 7811, 7821, 7832, 7841, 7861, 8811, 8832, 8841, 8845, 8851, 8861 and 8865 models (the 7832 and 8832 are conferencing-endpoint models). Fixed in Multiplatform Firmware 11.3.7SR1; release 12.0.1 and later are not affected.

What does this mean for affected devices?

CVE-2023-20078 (NVD Primary weakness CWE-787, out-of-bounds write; Cisco's own Secondary weakness classification is CWE-121, stack-based buffer overflow) affects the web-based management interface of Cisco's IP Phone 6800, 7800 and 8800 Series Multiplatform Phones. Cisco's security advisory states: "A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series Multiplatform Phones could allow an unauthenticated, remote attacker to inject arbitrary commands that are executed with root privileges" (Cisco Security Advisory cisco-sa-ip-phone-cmd-inj-KMFynVcP).

NVD's own description groups this with a companion denial-of-service flaw: "Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition" (NVD). The companion flaw, tracked separately as CVE-2023-20079, lets an unauthenticated attacker crash an affected phone, but Cisco notes exploitation of one does not require the other and a firmware release affected by one may not be affected by the other (Cisco Security Advisory cisco-sa-ip-phone-cmd-inj-KMFynVcP).

NVD lists its own Primary CVSS v3.1 base score of 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD); Cisco's own PSIRT-submitted Secondary score for the same vector is 9.8, the small difference coming from each party's own severity-scoring judgment rather than a factual disagreement about the bug.

NVD's structured platform (CPE) data for this CVE lists 17 distinct vulnerable Multiplatform Firmware identifiers, spanning the IP Phone 6825, 6841, 6851, 6861 and 6871 (6800 Series), the 7811, 7821, 7832, 7841 and 7861 (7800 Series, where the 7832 is a conferencing endpoint), and the 8811, 8832, 8841, 8845, 8851, 8861 and 8865 (8800 Series, where the 8832 is a conferencing endpoint) — all fixed in Multiplatform Firmware release 11.3.7SR1, with release 12.0.1 and later marked not affected (NVD).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.10351 (95.745th percentile) as of 2026-11-07 — a meaningfully elevated score for a phone-firmware bug, consistent with the critical, unauthenticated, root-level nature of the flaw (CISA KEV, FIRST EPSS).

Any Cisco IP Phone 6800, 7800 or 8800 Series device running Multiplatform Firmware earlier than 11.3.7SR1 should be updated, and its web-based management interface should not be exposed to untrusted networks in the meantime.

How to fix this class of issueThis advisory's weakness class is Memory corruption. Our practical guide covers how to detect, fix, verify and disclose it: How to fix memory corruption in embedded firmware.

Evidence

  • A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series Multiplatform Phones could allow an unauthenticated, remote attacker to inject arbitrary commands executed with root privileges. — Cisco Security Advisory cisco-sa-ip-phone-cmd-inj-KMFynVcP
  • NVD groups this with a companion DoS flaw (CVE-2023-20079); exploitation of one does not require the other, per Cisco's advisory. — NVD
  • NVD Primary CVSS v3.1 base score 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; Cisco's own Secondary score for the same vector is 9.8. — NVD
  • NVD's CPE configuration data lists 17 vulnerable Multiplatform Firmware identifiers across the IP Phone 6825/6841/6851/6861/6871, 7811/7821/7832/7841/7861 and 8811/8832/8841/8845/8851/8861/8865 models; fixed in Multiplatform Firmware 11.3.7SR1, not affected from release 12.0.1. — NVD
  • Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.10351 (95.745th percentile) as of 2026-11-07. — FIRST EPSS

Questions about this page?

hello@softwsp.com Chat with David on WhatsApp

Check if your firmware is affected

Get a firmware scan reportTrack this CVEChat with David on WhatsApp

Related advisories

CVE-2023-27997: FortiOS SSL-VPN Heap Overflow — CVSS 9.8, Critical severityCISA KEVCVE-2023-27997 ("XORtigate"): KEV pre-auth heap overflow RCE in FortiOS/FortiProxy SSL-VPN. Versions, patches, sourced to NVD, CISA KEV, Fortinet PSIRT.CVE-2023-4863: libwebp Heap Buffer Overflow Bundled in Mitsubishi Electric GENESIS64/ICONICS Suite — CVSS 8.8, High severityCISA KEVCVE-2023-4863: KEV heap buffer overflow in libwebp, bundled in Mitsubishi Electric GENESIS64 and ICONICS Suite SCADA/HMI products. Versions, fix, scoring, sourced to NVD, CISA KEV and CISA ICS advisory.CVE-2024-12248: Contec CMS8000 Patient Monitor Out-of-Bounds Write Enables Remote Code ExecutionCVE-2024-12248: a remote attacker can send specially formatted UDP requests to Contec Health's CMS8000 patient monitor to write arbitrary data out of bounds, which CISA assesses could lead to remote code execution. NVD has not yet published its own Primary CVSS score; CISA's ICS-CERT Secondary rating is 9.8 (critical).

Sources

  1. NVD
  2. Cisco Security Advisory cisco-sa-ip-phone-cmd-inj-KMFynVcP
  3. CISA KEV
  4. FIRST EPSS

Frequently asked questions

What can an attacker do if they exploit CVE-2023-20078 on a Cisco IP Phone?

An unauthenticated, remote attacker who can reach the phone's web-based management interface can inject arbitrary commands that execute with root privileges on the device, giving them full control of the phone (per Cisco's advisory cisco-sa-ip-phone-cmd-inj-KMFynVcP; per NVD).

Which Cisco IP Phone models are affected, and does that include conferencing endpoints?

NVD's platform data lists 17 affected Multiplatform Firmware identifiers across the 6800 Series (6825, 6841, 6851, 6861, 6871), 7800 Series (7811, 7821, 7832, 7841, 7861) and 8800 Series (8811, 8832, 8841, 8845, 8851, 8861, 8865); the 7832 and 8832 are conferencing-endpoint models, so the issue covers both desk phones and conferencing hardware (per NVD).

How is CVE-2023-20078 fixed?

Cisco fixed the vulnerability in Cisco IP Phone Multiplatform Firmware release 11.3.7SR1; firmware release 12.0.1 and later is not affected, so devices should be updated to 11.3.7SR1 or a later unaffected release (per Cisco's advisory cisco-sa-ip-phone-cmd-inj-KMFynVcP; per NVD).