CVE-2025-20335: Cisco Desk Phone 9841 Auth Bypass Flaw

CVE-2025-20335 Overview

CVE-2025-20335 is an arbitrary file write vulnerability affecting Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 devices. The flaw stems from improper directory permissions and a lack of proper authentication controls on the phone's web interface. An unauthenticated, remote attacker can send a crafted request to an affected device and write arbitrary files to specific directories in the underlying operating system. Exploitation requires the Web Access feature to be enabled on the phone, which is disabled by default. The vulnerability is tracked under [CWE-284: Improper Access Control].

Critical Impact
Unauthenticated remote attackers can write arbitrary files to specific directories on affected Cisco phones when Web Access is enabled, potentially enabling persistence or tampering with device configuration.

Affected Products

Cisco Desk Phone 9800 Series (9841, 9851, 9861, 9871)
Cisco IP Phone 7800 Series (7811, 7821, 7841, 7861) and 8800 Series (8811, 8821, 8841, 8845, 8851, 8851NR, 8861, 8865)
Cisco Video Phone 8875

Discovery Timeline

2025-09-03 - CVE-2025-20335 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-20335

Vulnerability Analysis

The vulnerability resides in the web management interface exposed by affected Cisco phones. Directory permissions on the underlying Linux-based operating system are configured too permissively, and the web service does not enforce authentication for file write operations targeting those directories. An attacker on the same network segment as the phone can reach the web service and issue a crafted HTTP request that writes attacker-controlled content into predefined filesystem locations.

While the impact is limited to integrity of specific directories rather than full code execution or credential disclosure, arbitrary file writes on an embedded device can be leveraged to alter configuration state, drop content used by legitimate device processes, or establish a foothold for further attacks against the enterprise voice infrastructure.

Exploitation is gated by a non-default condition: Web Access must be enabled on the phone. In environments where administrators or provisioning workflows enable web access for troubleshooting, the attack surface is fully exposed to any network-reachable adversary.

Root Cause

The root cause is a combination of overly permissive directory permissions in the phone firmware and missing authentication controls on the HTTP endpoints that accept file write operations. This maps to [CWE-284: Improper Access Control], where the device fails to restrict who can perform privileged filesystem operations.

Attack Vector

Exploitation is performed remotely over the network without authentication or user interaction. The attacker sends a crafted HTTP request to the phone's web interface targeting the affected directories. No exploit code is publicly available in Exploit-DB, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Cisco Security Advisory for authoritative technical detail.

Detection Methods for CVE-2025-20335

Indicators of Compromise

Unexpected HTTP requests targeting the web management interface (typically TCP/80 or TCP/443) of Cisco Desk Phone 9800, IP Phone 7800/8800, or Video Phone 8875 devices from unfamiliar internal hosts.
Newly created or modified files in phone configuration or writable directories that do not correspond to a legitimate provisioning event.
Phone configuration or behavior changes without a corresponding action from Cisco Unified Communications Manager (CUCM) or an administrator.

Detection Strategies

Inventory all Cisco phones in scope and identify any device with Web Access enabled. Web Access should be treated as an exception rather than default state.
Inspect network flow records for unsolicited inbound HTTP/HTTPS connections to phone IP addresses from workstation or server subnets.
Correlate CUCM provisioning logs with any changes observed on phones to identify unauthorized modifications.

Monitoring Recommendations

Log and alert on any HTTP POST or PUT requests directed at phone endpoints, especially from non-administrative source IPs.
Enable syslog forwarding from phones and CUCM to a centralized logging platform and alert on configuration change events.
Monitor for phones whose firmware version does not match the fixed release published by Cisco.

How to Mitigate CVE-2025-20335

Immediate Actions Required

Disable Web Access on all Cisco Desk Phone 9800, IP Phone 7800/8800, and Video Phone 8875 devices unless explicitly required for administration.
Apply the fixed firmware referenced in the Cisco Security Advisory cisco-sa-phone-write-g3kcC5Df.
Restrict management network access to phones using ACLs so only authorized administrator subnets can reach the web interface.

Patch Information

Cisco has released fixed firmware for the affected phone families. Administrators should consult the Cisco Security Advisory for the exact fixed release for each model, including the Desk Phone 9800 Series, IP Phone 7800/8800 Series (previously running 14.3(1) and earlier), Video Phone 8875 (previously running 2.3(1) and earlier), and IP Phone 8821 (previously running 11.0(6) and earlier service releases).

Workarounds

Ensure Web Access remains disabled, which is the default configuration and fully mitigates the vulnerability.
Segment voice VLANs from user workstation VLANs and enforce ACLs blocking HTTP/HTTPS to phone IP ranges from untrusted subnets.
Use CUCM to centrally push configuration profiles that keep Web Access disabled and prevent local override.

bash

# Example CUCM enterprise phone configuration to disable Web Access
# Cisco Unified CM Administration > Device > Phone > (select phone or profile)
# Product Specific Configuration Layout:
#   Web Access: Disabled
#   SSH Access: Disabled
# Save and Apply Config to push change to endpoints