CVE-2025-20351: Cisco Desk Phone 9871 XSS Vulnerability

CVE-2025-20351 Overview

CVE-2025-20351 is a reflected cross-site scripting (XSS) vulnerability in the web UI of multiple Cisco IP phone product lines running Cisco SIP Software. The flaw affects the Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and the Cisco Video Phone 8875. An unauthenticated remote attacker can exploit the vulnerability by persuading a user to click a crafted link. Successful exploitation allows arbitrary script execution in the context of the web UI or access to sensitive browser-based information. Exploitation requires the phone to be registered with Cisco Unified Communications Manager (CUCM) and to have Web Access enabled, which is disabled by default.

Critical Impact
Arbitrary script execution in the phone web UI enables session data theft and unauthorized actions against the interface when a targeted user visits a crafted link.

Affected Products

Cisco Desk Phone 9800 Series (9841, 9851, 9861, 9871) running Cisco SIP Software
Cisco IP Phone 7800 Series (7811, 7821, 7841, 7861) and 8800 Series (8811, 8821, 8832, 8841, 8845, 8851, 8861, 8865) running Cisco SIP Software
Cisco Video Phone 8875 running Cisco SIP Software

Discovery Timeline

2025-10-15 - CVE-2025-20351 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-20351

Vulnerability Analysis

The vulnerability is a cross-site scripting flaw classified under [CWE-79]. It resides in the web-based administrative interface exposed by affected Cisco SIP phone firmware. The interface returns user-supplied input to the browser without sufficient neutralization of active content. An attacker who convinces an authenticated web UI user to click a crafted URL can trigger execution of attacker-controlled JavaScript inside the victim's browser session. Because the script runs in the origin of the phone's web UI, it can read tokens, exfiltrate configuration data, or issue authenticated requests on behalf of the user.

Root Cause

The root cause is improper input validation and output encoding in the web UI request handlers. Parameters supplied by remote clients are reflected into HTML responses without contextual escaping. This allows HTML and JavaScript payloads embedded in a URL to be interpreted as active content by the victim's browser rather than treated as inert text.

Attack Vector

Exploitation occurs over the network and requires user interaction. Two preconditions must be met on the target device: registration with Cisco Unified Communications Manager and enablement of Web Access, which ships disabled by default. The attacker crafts a URL containing a malicious payload targeting the vulnerable web UI endpoint and delivers it via phishing, chat, or another social vector. When the victim clicks the link while authenticated to the phone's web interface, the injected script runs in the context of that interface.

No verified public exploit code is available. See the Cisco Security Advisory for authoritative technical details.

Detection Methods for CVE-2025-20351

Indicators of Compromise

HTTP GET or POST requests to phone web UI endpoints containing URL-encoded <script>, javascript:, onerror=, or onload= payloads.
Outbound requests from browser sessions to unexpected external hosts shortly after a user accesses a phone administration URL.
Unusual configuration changes or password modifications on phones with Web Access enabled.

Detection Strategies

Inspect proxy and web gateway logs for referrer and request patterns matching phone management IP ranges combined with reflected script markers.
Deploy a web application firewall or IDS signature that matches XSS payload patterns in query strings targeting Cisco phone UI paths.
Correlate email and messaging telemetry for URLs pointing to internal phone management addresses containing encoded HTML entities.

Monitoring Recommendations

Enumerate the environment for phones with Web Access enabled and monitor authenticated sessions against those interfaces.
Log all administrative actions performed via the phone web UI and alert on anomalous configuration changes.
Alert on any external delivery of links containing internal phone management hostnames or IP addresses.

How to Mitigate CVE-2025-20351

Immediate Actions Required

Disable Web Access on all affected Cisco phones unless it is explicitly required for operational needs.
Apply the fixed Cisco SIP Software release identified in the vendor advisory to all affected phone models.
Restrict network reachability to phone management interfaces through VLAN segmentation and access control lists.
Educate administrators to avoid clicking untrusted links while authenticated to phone web UIs.

Patch Information

Cisco has published fixed software for the affected phone product lines. Refer to the Cisco Security Advisory cisco-sa-phone-dos-FPyjLV7A for the specific fixed releases per model and upgrade guidance.

Workarounds

Leave Web Access disabled, which is the vendor default, on all phones that do not require web administration.
Confine phone management traffic to a dedicated management VLAN accessible only from trusted administrative workstations.
Use browser isolation or a dedicated browser profile for phone administration to reduce the impact of a successful XSS payload.

bash

# Configuration example: disable Web Access via Cisco Unified Communications Manager
# In CUCM Administration:
#   Device > Phone > [select phone]
#   Set 'Web Access' to 'Disabled'
#   Save and Apply Config
# Verify at the bulk configuration level:
#   Bulk Administration > Phones > Update Phones > Query
#   Filter: Web Access = Enabled  (remediate any results)