A vulnerability in the directory permissions of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated, remote attacker to access sensitive information on an affected device. This vulnerability exists because the product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. An attacker could exploit this vulnerability by sending a crafted packet to the IP address of a device that has Web Access enabled. A successful exploit could allow the attacker to access sensitive information from the device. Note: To exploit this vulnerability, Web Access must be enabled on the phone. Web Access is disabled by default.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

根據其自我報告的版本號碼執行 SIP 軟體的遠端 Cisco Desk、IP 或 Video Phone 受到多個弱點影響這些弱點可允許未經驗證的遠端攻擊者發動任意檔案寫入和資訊洩漏攻擊。若要惡意利用這些弱點必須在電話上啟用 Web Access。Web Access 預設為停用狀態。

如需詳細資訊，請參閱隨附的 Cisco BID 和 Cisco 安全公告。

根据其自我报告的版本运行 SIP 软件的远程 Cisco Desk、IP 或视频电话受到多个漏洞的影响这些漏洞允许未经身份验证的远程攻击者发动任意文件写入和信息泄露攻击。若要利用这些漏洞必须在手机上启用 Web 访问。默认情况下禁用 Web 访问。

请参阅随附的 Cisco BID 和 Cisco 安全公告，了解更多信息。

自己報告されたバージョンによると、SIPソフトウェアを実行しているリモートのCisco Desk、IP、Video Phoneは複数の脆弱性の影響を受けます。これにより、認証されていないリモートの攻撃者が、任意のファイル書き込み攻撃や情報漏えい攻撃を仕掛ける可能性があります。これらの脆弱性を悪用するには、電話で Web アクセスが有効になっている必要があります。Web Access はデフォルトで無効になっています。

詳細については、付属の Cisco BID および Cisco Security Advisory を参照してください。

According to its self-reported version, the remote Cisco Desk, IP or Video Phone running SIP Software is affected by multiple vulnerabilities that could allow an unauthenticated, remote attacker to conduct arbitrary file write and information disclosure attacks. To exploit these vulnerabilities, Web Access must be enabled on the phone. Web Access is disabled by default.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

ID	Name	Product	Family	Published	Updated	Severity
505007	Cisco IP Phones Exposure of Sensitive Information to an Unauthorized Actor (CVE-2025-20336)	Tenable OT Security	Tenable.ot	1/20/2026	2/4/2026	high
264636	Cisco Desk/IP/Video Phone 多個弱點 (cisco-sa-phone-write-g3kcC5Df)	Nessus	CISCO	9/12/2025	9/12/2025	medium
264636	Cisco Desk/IP/视频电话多种漏洞 (cisco-sa-phone-write-g3kcC5Df)	Nessus	CISCO	9/12/2025	9/12/2025	medium
264636	Cisco Desk/IP/Video Phone の複数の脆弱性cisco-sa-phone-write-g3kcC5Df	Nessus	CISCO	9/12/2025	9/12/2025	medium
264636	Cisco Desk/IP/Video Phone Multiple Vulnerabilities (cisco-sa-phone-write-g3kcC5Df)	Nessus	CISCO	9/12/2025	9/12/2025	medium

Detections

Analytics

Plugins Search

high

medium

medium

medium

medium