CVE-2020-3161

Cisco IP phones had an unpatched remote code execution vulnerability exploited in the wild, allowing attackers to gain root access.

Cisco IP phones contained an improper input validation flaw in their web server that allowed remote code execution with root privileges. This unpatched vulnerability was actively exploited in the wild, posing a severe risk to DIB organizations relying on Cisco hardware for network access and voice communications. Organizations must ensure all Cisco IP phones are patched to prevent attackers from executing arbitrary code and compromising network infrastructure.

Shame score — The vulnerability was unpatched and actively exploited in the wild, demonstrating a failure to address known security flaws and leaving critical network hardware vulnerable to remote code execution.