CVE-2020-3574: cisco cisco ip phones with multiplatform firmware State Issues
Vulnerability summary
CVE-2020-3574 is a high (CVSS 7.8) State Issues vulnerability in cisco cisco ip phones with multiplatform firmware. EPSS estimates a 8.03% chance of exploitation in the next 30 days, higher than 94.7% of scored vulnerabilities.
Timeline
- 06-11-2020PublishedVulnerability first disclosed.
- 13-11-2024Last modifiedVulnerability information updated.
Description
A vulnerability in the TCP packet processing functionality of Cisco IP Phones could allow an unauthenticated, remote attacker to cause the phone to stop responding to incoming calls, drop connected calls, or unexpectedly reload. The vulnerability is due to insufficient TCP ingress packet rate limiting. An attacker could exploit this vulnerability by sending a high and sustained rate of crafted TCP traffic to the targeted device. A successful exploit could allow the attacker to impact operations of the phone or cause the phone to reload, leading to a denial of service (DoS) condition.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
8.03%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
0.00 pp
From 8.03% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Cisco9 products
- cisco ip phones with multiplatform firmwaren/a
- ip_dect_210_firmware< 4.8.1
- ip_dect_6825_firmware< 4.8.1
- ip_phone_8811_firmware< 11.3.2
- ip_phone_8841_firmware< 11.3.2
1 vendor · 9 products
References
1 links- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voip-phone-flood-dos-YnU9EXOvVendor AdvisoryX Refsource CISCOPatch