This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Cisco fixes 7 vulnerabilities

Cisco fixes 7 vulnerabilities in its products. The most severe ones are listed below, the remaining ones can be found at [1][2][3][4]. Products and their fixed versions: Cisco SIP Software - 3.3(1), 11.0(6)SR7, 14.4(1) [1] Cisco TelePresence CE and RoomOS - 11.32.2.1 [4] The availability of a fix for Cisco IOS XE Software [2], Cisco Secure Firewall ASA, Secure FMC and Secure FTD Software [3] can be verified using the Cisco Software Checker tool [5].

Cisco Session Initiation Protocol (SIP) Software - DoS (CVE-2025-20350)
CVSS 7.5 (High)

Allows an unauthenticated remote attacker to perform a DoS attack due to a buffer overflow in the processing of HTTP packets in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series and Cisco Video Phone 8875 with Cisco SIP Software installed. To exploit the vulnerability, the phone must be registered with Cisco Unified Communications Manager and have access to the web interface enabled [1].

The vulnerability is present in product:

  • Cisco SIP Software; <=2.3(1)SR1; >=3.0, <3.3(1); <11.0; >=11.0, <11.0(6)SR7; <14.3; >=14.3,<14.3(1)SR2

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 15. 10. 2025.

Cisco IOS XE - code execution (CVE-2025-20313, CVE-2025-20314)
CVSS 6.7 (Medium)

Allows an authenticated local attacker with privilege level 15 or an unauthenticated attacker with physical access to the affected device to execute code due to insufficient verification of software packages in Cisco IOS XE [2].

The vulnerability is present in product:

  • Cisco IOS XE;

CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X

More information:

The vulnerability was publicly disclosed 15. 10. 2025.

Cisco Session Initiation Protocol (SIP) Software - XSS (CVE-2025-20351)
CVSS 6.1 (Medium)

Allows an unauthenticated remote attacker to perform an XSS attack due to insufficient validation of user input in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series and Cisco Video Phone 8875 with Cisco SIP Software installed. To exploit the vulnerability, the phone must be registered with Cisco Unified Communications Manager and have access to the web interface enabled [1].

The vulnerability is present in product:

  • Cisco SIP Software; >=3.0, <3.3(1); <11.0; >=11.0, <11.0(6)SR7; <14.0; >=14.3, <14.4(1)

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

More information:

  • CVE-2025-20351 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 15. 10. 2025.

By CESNET, z.s.p.o. Michaela Jarošová on 20. 10. 2025.

CESNET, z.s.p.o. Logo