Cisco Patches High-Severity CVE-2025-20350 DoS Flaw in Desk and IP Phones

Cisco has released patches for two vulnerabilities (CVE-2025-20350 – buffer overflow enabling remote DoS, CVE-2025-20351 – insufficient input validation enabling XSS) affecting multiple Cisco Desk and IP Phone models (9800, 7800, 8800, 8875 series). Both issues require Web Access to be enabled and the device registered to Cisco Unified Communications Manager to be exploitable; Web Access is disabled by default, limiting exposure, and Cisco recommends applying the provided fixed SIP Software releases.