Insufficient Input Validation in Cisco Video Phone and Desk Phone Products
CVE-2025-20158
4.4MEDIUM
What is CVE-2025-20158?
A flaw in the debug shell of certain Cisco Video Phones and Desk Phones allows an authenticated, local attacker with valid SSH credentials to gain unauthorized access to sensitive information on the device. The exploitation is made possible due to inadequate validation of commands supplied by the user. Although SSH access is disabled by default, attackers could circumvent this restriction, potentially exposing critical system data by sending specially crafted commands to the device's command-line interface.
Affected Version(s)
Cisco Session Initiation Protocol (SIP) Software 3.1(1)
Cisco Session Initiation Protocol (SIP) Software 3.0(1)
Cisco Session Initiation Protocol (SIP) Software 2.3(1)