Cisco RoomOS Buffer Overflow (cisco-sa-roomos-bof-vTMANZgu)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(341182);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/31");

  script_cve_id("CVE-2026-20302");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwu31332");
  script_xref(name:"CISCO-SA", value:"cisco-sa-roomos-bof-vTMANZgu");
  script_xref(name:"IAVA", value:"2026-A-0895");

  script_name(english:"Cisco RoomOS Buffer Overflow (cisco-sa-roomos-bof-vTMANZgu)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco RoomOS Software is affected by a vulnerability.

  - A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with
    physical access to the USB port on an affected device to execute arbitrary code with root privileges.
    This vulnerability is due to insufficient boundary checks for specific data that is provided through the
    USB driver. An attacker could exploit this vulnerability by connecting a malicious USB device to an
    affected device. A successful exploit could allow the attacker to cause a buffer overflow condition on
    the affected system and execute arbitrary code with root privileges. (CVE-2026-20302)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-bof-vTMANZgu
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?435297ec");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu31332");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwu31332");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-20302");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/28");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:telepresence_collaboration_endpoint");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_telepresence_mcu_detect.nasl");
  script_require_keys("Cisco/TelePresence_MCU/Device", "Cisco/TelePresence_MCU/Version");

  exit(0);
}

include('ccf.inc');

var app_name = 'Cisco RoomOS Software';
var version = get_kb_item_or_exit('Cisco/TelePresence_MCU/Version');
var device = get_kb_item_or_exit('Cisco/TelePresence_MCU/Device');
device = tolower(device);

if ('telepresence' >!< device && 'room' >!< device)
  audit(AUDIT_HOST_NOT, 'a vulnerable device');

var ver_list = split(version, sep:'.', keep:FALSE);
var max_ver_segs = max_index(ver_list);
var short_version;

# versions appear like ce9.13.0.990355df13a and ce10.13.1.3.dd7ec0ed589
if (max_ver_segs >= 5)
  short_version = pregmatch(pattern: "^(ce)(\d+(?:\.\d+){0,3})", string:version);
else
  short_version = pregmatch(pattern: "^(ce)(\d+(?:\.\d+){0,2})", string:version);

var short_num, short_type;
if (empty_or_null(short_version))
  audit(AUDIT_NOT_DETECT, app_name);
else
{
  short_type = short_version[1];
  short_num = short_version[2];
}

if (short_type != 'ce')
  audit(AUDIT_NOT_DETECT, app_name);

var product_info = {
  'version' : short_num
};

# Advisory 'Fixed Releases' table, First Fixed Release for RoomOS in On-Premises
# Operation: release '11 and earlier' is fixed in 11.32.7.0, release '26' is fixed
# in 26.7.2.2. Cloud-aware releases (11.40.1.1 / 26.7.1.12) are not covered here
# because this plugin keys off the on-premises FTP/SNMP version detection.
var vuln_ranges = [
  {'min_ver' : '0.0',  'fix_ver' : '11.32.7.0'},
  {'min_ver' : '26.0', 'fix_ver' : '26.7.2.2'}
];

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_WARNING,
  'version'       , version,
  'bug_id'        , 'CSCwu31332',
  'disable_caveat', TRUE
);

cisco::check_and_report(
  product_info      :product_info,
  reporting         :reporting,
  vuln_ranges       :vuln_ranges
);