Cisco TelePresence Collaboration Endpoint Software and RoomOS Software DoS (cisco-sa-tce-roomos-dos-9V9jrC2q)

#TRUSTED 120a44094e6cd34c4b1190a5f6efb580af0990d8b9dd5eb97f53bff7c9e031fb2d1b329f89b6259673bc1340923dce02e8dfc21a4595b63f648f0359577a4199ca7d70e4da2ebda8b228f66718890229b7b3ae16abcde5f2cf4e6de4d1297428efef3a89e154d10449bc6ee0550f46c0ea82f0b31183c4ec4fcb2187de9c2c5f1db0f9f68dcea52024a0d3c030c827db083fe3135f8c26f6a0afd4b6d0ff4dfcb54b0c874740abb49b381d5d560ac80aa9bd4046905e077eca4c96f0a140cb3118c551627b513f3415b2c541a31bef86c44070794f7773e9227f9aa28555b49908adc118999bb0a7e4f7a866706af65cd52edcacb3d7c56f44ee6d4837b751726c598a2955c4d179e94d0546f40c5cf06238d3ad5c24599cbc5a6b2ef2ae11faf64fc1823e96a6028718c7b84a5b3ebce552eb72b014e9dfab6ad0671c524beb91b96bf96ad64162f4b13097ca87be2a191cd6942f1cab26b92de2522ff26fba012644816aabb879f81056b19a531323c44bdba810fdb759215517a05302c78f0223f9fa7c02c3a6585be8290a0ead7ce5a1df4b66c4f120a1e2b8eb927962a00bd077417aad2be58f10ba74ab23b7e55bc1678fcc10be98a460468b4f4bfc95faf73a16771f5c5c3ed89f1ecf850418663a53ec8f218564324c592370245d71d2eb16b6dff02e25b952a073de7e0a227fea2a0642b82e378606ab4e369ddbd7
#TRUST-RSA-SHA256 508ea6e89bac170576edf2d2c605787a75d476a49e92a1d2914a7fb842efcd65de5ff96f74c6585d24c168251ace394d84ef2594da4cee0bd493ef171484465cb34e9f0ad4e5038484803ea9ca9cc5317b7ef7d3d76e798380fd4b9f99d8f523fd2bd6afecb8aff0ab3f8d6e0596cae7a12961680cc7e7c31f727efa1199e999cc0237253530e04877e3aeb0743ab26b2a2f3cfe4297fb2a828ccdb92479533bce0bbccc5a4e432eb236d952f6f1be48bad0c82c202ff457dbcf0116800ceedeaf405dcbf8cd010dd8462a182b8239e355d8c2c7275a2b2f0f402530bc40fa25c6fadb6ee53c0bd314bc858917ee652f49fcd074662db899202ac3a7c36b261fb4f0679b3328164be36ea3bba576af58a87cfede08189e0e3f9dd74db0f5ce42eca2cf424679fcc2836f3a9cb5b1bbaba94358962b5227b4c1dcb2087272e248cfddf7e7b94ab9948305877e53f4be51906d8147b64a2c03433a781050fa32192b5bdfbe94f00f1fd569f986f11094d227f657004375367614cb325765a4766658397ded7a3ee1cf0cfc9ec802a1730b89f04c5539a0fc1148927d782b6305f5c2df71c08aca26d14883eecab5c3abc8c1e006386bd4da17d34542b2647af4c440cda6b6602f498a973695901c813c9fcafa3c33b4092f0210382d8bb8e86ccab5147d16a347e6acfa3ccd927af62e0ab38b23baddc306235d0462e0d7dbabc1
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(298242);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/06");

  script_cve_id("CVE-2026-20119");
  script_xref(name:"CISCO-BUG-ID", value:"CSCws04170");
  script_xref(name:"CISCO-SA", value:"cisco-sa-tce-roomos-dos-9V9jrC2q");
  script_xref(name:"IAVA", value:"2026-A-0107");

  script_name(english:"Cisco TelePresence Collaboration Endpoint Software and RoomOS Software DoS (cisco-sa-tce-roomos-dos-9V9jrC2q)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco TelePresence Collaboration Endpoint Software and RoomOS Software Denial of
Service is affected by a vulnerability.

  - A vulnerability in the text rendering subsystem of Cisco TelePresence Collaboration Endpoint (CE) Software
    and Cisco RoomOS Software could allow an unauthenticated, remote attacker to cause a denial of service
    (DoS) condition on an affected device. This vulnerability is due to insufficient validation of input
    received by an affected device. An attacker could exploit this vulnerability by getting the affected
    device to render crafted text, for example, a crafted meeting invitation. As indicated in the CVSS score,
    no user interaction is required, such as accepting the meeting invitation. A successful exploit could
    allow the attacker to cause the affected device to reload, resulting in a DoS condition. (CVE-2026-20119)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tce-roomos-dos-9V9jrC2q
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3ce451b0");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCws04170");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCws04170");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-20119");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(1287);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/02/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/02/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/06");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:telepresence_collaboration_endpoint");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_telepresence_mcu_detect.nasl");
  script_require_keys("Cisco/TelePresence_MCU/Device", "Cisco/TelePresence_MCU/Version");

  exit(0);
}


include('ccf.inc');

var app_name = 'Cisco TelePresence CE software';
var version = get_kb_item_or_exit('Cisco/TelePresence_MCU/Version');
var device = get_kb_item_or_exit('Cisco/TelePresence_MCU/Device');
device = tolower(device);

if ('telepresence' >!< device && 'room' >!< device)
  audit(AUDIT_HOST_NOT, 'a vulnerable device');

var ver_list = split(version, sep:'.', keep:FALSE);
var max_ver_segs = max_index(ver_list);
var short_version;

# versions appear like ce9.13.0.990355df13a and ce10.13.1.3.dd7ec0ed589
if (max_ver_segs >= 5)
  short_version = pregmatch(pattern: "^(ce)(\d+(?:\.\d+){0,3})", string:version);
else
  short_version = pregmatch(pattern: "^(ce)(\d+(?:\.\d+){0,2})", string:version);

var short_num, short_type;
if (empty_or_null(short_version))
  audit(AUDIT_NOT_DETECT, app_name);
else
{
  short_type = short_version[1];
  short_num = short_version[2];
}

if (short_type != 'ce')
  audit(AUDIT_NOT_DETECT, app_name);

var product_info = {
  'version' : short_num
};

var vuln_ranges = [
  {'min_ver' : '0.0', 'fix_ver' : '11.27.5.0'},
  {'min_ver' : '11.32', 'fix_ver' : '11.32.3.0'}
];

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_HOLE,
  'version'       , version,
  'bug_id'        , 'CSCws04170',
  'disable_caveat', TRUE
);

cisco::check_and_report(
  product_info      :product_info,
  reporting         :reporting,
  vuln_ranges       :vuln_ranges
);