CVE-2020-16138 in the critical feed json
A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the dev…
published 2020-08-12 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-8104
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 21.4%
- EPSS 21.4% chance of exploitation in 30 days, percentile 97%
- public exploits
- 1
- Metasploit
Summary
A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the device until it is power cycled. Note: We cannot prove this vulnerability exists. Out of an abundance of caution, this CVE is being assigned to better serve our customers and ensure all who are still running this product understand that the product is end of life and should be removed or upgraded. For more information on this, and how to upgrade, refer to the CVE’s reference information
Timeline
- First public exploit (Metasploit auxiliary/dos/cisco/cisco_7937g_dos)
- Published
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
21.36% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit auxiliary/dos/cisco/cisco_7937g_dos Cisco 7937G Denial-of-Service Attack metasploit auxiliary, normal rank, 2020-06-02
- packetstormsecurity.com https://packetstormsecurity.com/files/158819/Cisco-7937G-Denial-Of-Service.html referenced PoC, tagged "exploit" by a source, unverified
- blacklanternsecurity.com https://www.blacklanternsecurity.com/2020-08-07-Cisco-Unified-IP-Conference-Station-7937G/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 7.8 | AV:N/AC:L/Au:N/C:N/I:N/A:C |
References
-
packetstormsecurity.com
/files/158819/Cisco-7937G-Denial-Of-Service.html
exploit, third-party-advisory, vdb-entry
-
blacklanternsecurity.com
/2020-08-07-Cisco-Unified-IP-Conference-Station-7937G/
exploit, third-party-advisory
-
cisco.com
/c/en/us/products/collateral/collaboration-endpoints/unified-ip-phone-7940g/end_of_life_notice_c51-729487.html
vendor-advisory
Sources
- CVE List CVE-2020-16138
- NVD CVE-2020-16138
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.