CVE-2026-20281: Cisco IP Phone SIP Software DoS Vulnerability

CVE-2026-20281 Overview

CVE-2026-20281 is a memory leak vulnerability [CWE-401] affecting Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 devices running Cisco Session Initiation Protocol (SIP) Software. An unauthenticated, remote attacker can trigger a denial of service (DoS) condition by sending a continuous stream of crafted HTTP packets. The affected device continuously consumes memory until it becomes unresponsive. Recovery requires a manual reboot. Exploitation requires the phone to be registered to Cisco Unified Communications Manager (Unified CM) and to have Web Access enabled. Web Access is disabled by default, which limits the exposed attack surface.

Critical Impact
Remote unauthenticated attackers can exhaust device memory and force manual reboots of affected Cisco SIP phones, disrupting enterprise voice communications.

Affected Products

Cisco Desk Phone 9800 Series running Cisco SIP Software
Cisco IP Phone 7800 and 8800 Series running Cisco SIP Software
Cisco Video Phone 8875 running Cisco SIP Software

Discovery Timeline

2026-09-02 - CVE-2026-20281 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-20281

Vulnerability Analysis

The vulnerability resides in the HTTP packet processing path of the Cisco SIP Software running on affected phone models. When the device parses incoming HTTP packets, allocated memory is not properly released after processing. Sustained delivery of crafted HTTP packets causes memory consumption to grow without bound. The phone eventually becomes unresponsive, dropping registered SIP sessions and blocking voice services. A manual reboot is the only recovery path, since the leaked memory is not reclaimed at runtime.

Root Cause

The root cause is improper memory management [CWE-401 Missing Release of Memory After Effective Lifetime] in the HTTP request handler exposed by the Web Access feature. Memory allocated for request state or parsing structures is not freed on all code paths. Repeated malformed or crafted requests accumulate residual allocations in the device's memory pool.

Attack Vector

An attacker on the network can reach the phone's embedded web interface when Web Access is enabled and the phone is registered to Unified CM. No authentication or user interaction is required. The attacker sends a continuous stream of crafted HTTP packets to the device's web service endpoint. Each request contributes to the memory leak, and the DoS condition materializes once available memory is exhausted. Because Web Access is disabled by default, deployments that have explicitly enabled it face the highest exposure. See the Cisco Security Advisory: Phone DoS Vulnerability for vendor-specific technical details.

Detection Methods for CVE-2026-20281

Indicators of Compromise

Sustained high-rate HTTP traffic directed at phone IP addresses on the voice VLAN
Repeated unexpected reboots or unresponsive phones registered to Cisco Unified CM
Loss of SIP registration for multiple phones followed by manual reboot recovery
Unusual source addresses initiating HTTP connections to endpoints on voice segments

Detection Strategies

Inspect NetFlow or IPFIX records for repetitive HTTP sessions targeting the voice VLAN from a single source
Alert on phones losing SIP registration to Unified CM in clusters or short time windows
Correlate SNMP memory utilization trends from managed phones with inbound HTTP request volume
Monitor Unified CM call-processing logs for endpoints entering an unregistered state without a corresponding network outage

Monitoring Recommendations

Enable NetFlow on distribution switches serving voice VLANs and baseline normal HTTP traffic to phones
Track Unified CM device registration events centrally and alert on abnormal deregistration counts
Log firewall or ACL denies for HTTP traffic originating outside the voice management network

How to Mitigate CVE-2026-20281

Immediate Actions Required

Disable Web Access on all Cisco Desk Phone 9800, IP Phone 7800/8800, and Video Phone 8875 devices unless operationally required
Apply the fixed Cisco SIP Software release referenced in the vendor advisory as soon as it is available for your model
Restrict inbound HTTP traffic to phones using switch ACLs so only authorized management hosts can reach them
Segment voice VLANs from general user and guest networks to reduce reachable attack surface

Patch Information

Cisco has published fixed software as part of the Cisco Security Advisory: Phone DoS Vulnerability. Administrators should consult the advisory for the specific fixed release train that applies to each phone model and upgrade using Cisco Unified CM firmware assignment.

Workarounds

Disable Web Access on affected phones through Cisco Unified CM product-specific configuration (Web Access is disabled by default)
Deploy access control lists on access-layer switches to block HTTP to phone endpoints from untrusted sources
Restrict Unified CM phone registration to authorized network segments to limit exposure of vulnerable endpoints

bash

# Example switch ACL restricting HTTP access to voice VLAN endpoints
# Replace 10.10.20.0/24 with your voice VLAN and 10.10.99.10 with an authorized management host
ip access-list extended VOICE-HTTP-RESTRICT
 permit tcp host 10.10.99.10 10.10.20.0 0.0.0.255 eq 80
 deny   tcp any 10.10.20.0 0.0.0.255 eq 80
 permit ip any any
!
interface range GigabitEthernet1/0/1 - 48
 ip access-group VOICE-HTTP-RESTRICT in