Main Vulnerability Database Vulnerabilities #VU104102

Information disclosure in Cisco Systems, Inc products - CVE-2025-20158

Published: February 20, 2025

Vulnerability identifier: #VU104102

CSH Severity: Low

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-20158

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in the debug shell. A local administrator can send a specially crafted SSH client command and gain unauthorized access to sensitive information on the system.

Affected software

Video Phone 8875
Desk Phone 9800 Series
SIP IP Phone Software

How to mitigate CVE-2025-20158

Install updates from vendor's website.

SIP IP Phone Software - update to 3.3(1)

External References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-phone-info-disc-YyxsWStK

Related Security Bulletins