PT-2025-35814 · Cisco · Cisco Desk Phone 9800 Series+3

Zach Sanchez · Published 2025-09-03 · Updated 2026-01-05 · CVE-2025-20336

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Desk Phone 9800 Series Cisco IP Phone 7800 and 8800 Series Cisco Video Phone 8875

Description A vulnerability in the directory permissions of the affected devices could allow an unauthenticated, remote attacker to access sensitive information. The vulnerability exists because the product exposes sensitive information to an unauthorized actor. An attacker could exploit this by sending a crafted packet to the IP address of a device with Web Access enabled. A successful exploit could allow the attacker to access sensitive information from the device.

Recommendations Ensure Web Access is disabled on the devices, as it is disabled by default.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2026-01766

CVE-2025-20336

Affected Products

Cisco Desk Phone 9800 Series

Cisco Ip Phone 7800 Series

Cisco Ip Phone 8800 Series

Cisco Video Phone 8875

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-20336 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-phone-write-g3kcC5Df · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-20336 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01766 · Security Note
• https://twitter.com/CVEnew/status/1963298505205678308 · Twitter Post
• https://t.me/cveNotify/147703 · Telegram Post
• https://t.me/CVEtracker/31623 · Telegram Post