SecBoard
Zurück zur CVE-Übersicht

CVE-2026-20281

HIGH(7.5)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Risk Signal Score19/100 — NIEDRIG
  • CVSS 7.5 — Hoch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.3%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

7.5

Technische Schwere

Beschreibung

A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that are running Cisco Session Initiation Protocol (SIP) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper memory management when an affected device processes HTTP packets. An attacker could exploit this vulnerability by sending a continuous stream of crafted HTTP packets to the device. A successful exploit could allow the attacker to cause the affected device to continuously consume memory, resulting in a DoS condition. A manual reboot of the device is required to recover from this condition. Note: For this vulnerability to be exploitable, the phone must be registered to Cisco Unified Communications Manager (Unified CM) and have Web Access enabled. Web Access is disabled by default.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Diese Schwachstelle betrifft Cisco Desk Phones, IP Phones und Video Phones, die Cisco SIP Software ausführen und bei Cisco Unified Communications Manager registriert sind, wenn Web Access aktiviert ist. Die Ausnutzung erfolgt durch das Senden eines kontinuierlichen Stroms von manipulierten HTTP-Paketen, was zu einem Denial of Service (DoS) durch übermäßigen Speicherverbrauch führt. Eine direkte ne

Sentinel/Defender KQL

let target_devices = dynamic(['<IP_of_Cisco_Phone_1>', '<IP_of_Cisco_Phone_2>']);
NetworkEvents
| where DestinationIP in (target_devices)
| where Protocol == 'http' or DestinationPort == 80 or DestinationPort == 443 // Assuming HTTP/HTTPS traffic
| summarize PacketCount = count(), TotalBytes = sum(TotalBytes) by bin(TimeGenerated, 1m), SourceIP, DestinationIP
| where PacketCount > <threshold_for_unusual_http_traffic_rate> // Adjust threshold based on baseline
| project TimeGenerated, SourceIP, DestinationIP, PacketCount, TotalBytes
| extend AlertReason = 'Potentially high HTTP traffic to Cisco Phone, indicative of DoS attempt (CVE-2026-20281)'

Splunk SPL

index=<your_network_traffic_index> sourcetype=<your_network_traffic_sourcetype>
| where dest IN ("<IP_of_Cisco_Phone_1>", "<IP_of_Cisco_Phone_2>")
| where protocol="http" OR dest_port=80 OR dest_port=443
| timechart span=1m count as PacketCount, sum(bytes) as TotalBytes by src, dest
| where PacketCount > <threshold_for_unusual_http_traffic_rate>
| fields _time, src, dest, PacketCount, TotalBytes
| eval AlertReason = "Potentially high HTTP traffic to Cisco Phone, indicative of DoS attempt (CVE-2026-20281)"

Sigma

title: Cisco Phone DoS Attempt (CVE-2026-20281)
id: <unique_sigma_id>
status: experimental
description: Detects unusually high HTTP traffic directed at Cisco Desk/IP/Video Phones, potentially indicating a DoS attempt related to CVE-2026-20281.
author: SecBoard Operations
date: 2026/09/02
references:
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-phone-dos-txMYNRzv
tags:
  - attack.denial_of_service
  - cve.2026.20281
logsource:
  category: network_traffic
  product: firewall # or other network monitoring tool
detection:
  selection:
    dest_ip:
      - '<IP_of_Cisco_Phone_1>'
      - '<IP_of_Cisco_Phone_2>'
    protocol: 'http'
    # Or specify destination ports if protocol field is not reliable
    # dest_port:
    #   - 80
    #   - 443
  timeframe: 1m
  condition: selection | count() > <threshold_for_unusual_http_traffic_rate>
falsepositives:
  - Legitimate high traffic to phones (e.g., during firmware updates, mass provisioning) - requires tuning of threshold.
level: high

Elastic ES|QL

FROM <your_network_traffic_index>
WHERE destination.ip IN ('<IP_of_Cisco_Phone_1>', '<IP_of_Cisco_Phone_2>')
AND (network.protocol == 'http' OR destination.port == 80 OR destination.port == 443)
| STATS event_count = COUNT(), total_bytes = SUM(network.bytes) BY 1m_window = HISTOGRAM(@timestamp, INTERVAL 1 MINUTE), source.ip, destination.ip
| WHERE event_count > <threshold_for_unusual_http_traffic_rate>
| SELECT 1m_window, source.ip, destination.ip, event_count, total_bytes
| ENRICH AlertReason = 'Potentially high HTTP traffic to Cisco Phone, indicative of DoS attempt (CVE-2026-20281)'

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen