Insufficient Input Validation in Cisco Video Phone and Desk Phone Products

CVE-2025-20158

Summary

A flaw in the debug shell of certain Cisco Video Phones and Desk Phones allows an authenticated, local attacker with valid SSH credentials to gain unauthorized access to sensitive information on the device. The exploitation is made possible due to inadequate validation of commands supplied by the user. Although SSH access is disabled by default, attackers could circumvent this restriction, potentially exposing critical system data by sending specially crafted commands to the device's command-line interface.

References