CVE-2022-20793

CVE-2022-20793 affects Cisco TelePresence CE Software and RoomOS Software for Cisco Touch 10 devices. The root cause is insufficient identity verification in the pairing process, allowing an unauthenticated, remote attacker to impersonate a legitimate device and pair with an affected device. A su...

CVE-2022-20783

Cisco CVE-2022-20783 is a denial-of-service vulnerability in the packet processing path of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software. The issue stems from insufficient input validation and can be triggered by sending crafted H.323 traffic from an unauthenti...

CVE-2022-20794

CVE-2022-20794 covers multiple vulnerabilities in the web engine of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software. The issues could allow a remote attacker to cause a DoS, view sensitive data on the affected device, or redirect users to an attacker-controlled d...

CVE-2023-20002

Cisco TelePresence CE and RoomOS Software are affected by an SSRF vulnerability due to improper validation of user-supplied input. An authenticated, local attacker could bypass access controls and cause the device to issue arbitrary network requests sourced from the affected system. Affected Cisc...

CVE-2023-20004

Three Cisco CVEs (CVE-2023-20004, CVE-2023-20092, CVE-2023-20093) affect the CLI of Cisco TelePresence CE and RoomOS. The root cause is improper access controls on local filesystem files, enabling an authenticated, local attacker to overwrite arbitrary files by placing a symbolic link in a specif...

CVE-2019-15288

The CVE-2019-15288 issue affects Cisco TelePresence CE/TC and RoomOS Software. It stems from insufficient input validation in the CLI, allowing an authenticated, remote attacker to exploit specific SSH arguments to escalate privileges to an unrestricted user in the restricted shell. Documented im...

CVE-2019-15967

The CVE-2019-15967 issue affects Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software. A vulnerability in the CLI allows an authenticated, local attacker to enable audio recording without user notification by exploiting unnecessary debug commands and gaining unrestricted acces...

CVE-2020-3336

CVE-2020-3336 affects Cisco TelePresence Collaboration Endpoint Software and Cisco RoomOS Software. Root cause: insufficient input validation during the software upgrade process. An attacker with administrative privileges can send malformed requests via console, SSH, or web API to modify device c...

CVE-2023-20091

CVE-2023-20091 affects Cisco TelePresence CE and RoomOS. A vulnerability in the CLI allows an authenticated, local attacker to overwrite arbitrary files on the device’s local filesystem by placing a symbolic link in a specific location, due to improper access controls on local files. Impact is lo...

CVE-2022-20764

Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software are affected by multiple vulnerabilities in the web engine that can allow a remote attacker to cause a denial of service, disclose sensitive data, or redirect users to attacker-controlled destinations. The Cisco advisory Cis...

CVE-2023-20008

CVE-2023-20008 affects Cisco TelePresence CE and RoomOS Software. A vulnerability in the CLI arises from improper local file access controls, allowing an authenticated, local attacker to overwrite arbitrary files by placing a symbolic link in a targeted location on the device’s local filesystem. ...

CVE-2023-20092

Cisco TelePresence CE and RoomOS CLI have three local arbitrary file-write vulnerabilities (CVE-2023-20092) due to improper local file access controls. An authenticated, local attacker could place a symbolic link to overwrite arbitrary files; exploitation requires a remote support user account. A...

CVE-2023-20090

The CVE-2023-20090 entry concerns Cisco TelePresence CE and RoomOS. Affected software suffers from improper access control on certain CLI commands, allowing an authenticated, local attacker to elevate privileges to root on an affected device. The impact is local privilege escalation with root acc...

CVE-2023-20094

This CVE (CVE-2023-20094) affects Cisco TelePresence CE and Cisco RoomOS. The issue is caused by improper bounds checks in the affected software, enabling an unauthenticated, adjacent attacker to send a crafted request that can trigger an out-of-bounds read, potentially disclosing sensitive infor...

CVE-2022-20954

Cisco CVE-2022-20954 affects Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software. The root cause is improper access controls and symlink handling in local file operations, enabling a local attacker to perform path traversal and potentially write arbitrary files on th...

CVE-2021-34758

CVE-2021-34758 affects Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software. The issue is in memory management due to insufficient access controls to a shared memory resource, allowing an authenticated local attacker to corrupt a shared memory segment and cause a DoS ...

CVE-2023-20093

CVE-2023-20093 : Three vulnerabilities in the Cisco TelePresence CE and RoomOS CLI could allow an authenticated, local attacker to overwrite arbitrary files on the local file system by placing a symbolic link in a specific location. Root cause: improper access controls on local files. Preconditio...

CVE-2019-15289

CVE-2019-15289 affects Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software. The issue is denial-of-service via the video service caused by insufficient input validation, exploitable by unauthenticated remote actors sending crafted traffic to the endpoint’s video service, whic...

CVE-2022-20776

CVE-2022-20776 affects Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software. The root cause is insufficient validation in the xAPI component, enabling path traversal on affected devices. An authenticated, local attacker could read/write arbitrary files and, per linked...

CVE-2022-20953

Cisco TelePresence CE and RoomOS Software are affected by multiple local, authenticated vulnerabilities leading to path traversal, sensitive data disclosure, and arbitrary file writes. Exploitation routes include excessive privileges for system commands (viewing keystrokes via USB, etc.) and syml...

CVE-2022-20811

CVE-2022-20811 affects Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software. The vulnerability stems from inadequate input validation in the xAPI leading to directory/path traversal, enabling an attacker to read and write arbitrary files on an affected device and pote...

CVE-2022-20955

The CVE-2022-20955 issue affects Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software. The root cause is improper access controls on local file system assets and the CLI, enabling authenticated, local attackers to overwrite arbitrary files via symbolic links and to pe...

CVE-2020-26068

CVE-2020-26068 affects Cisco Telepresence CE Software and Cisco RoomOS Software. A flaw in the xAPI service due to insufficient access authorization allows an authenticated remote attacker to generate an access token for an affected device, potentially enabling experimental features that should n...

CVE-2021-1532

CVE-2021-1532 affects Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software via the video endpoint API (xAPI). The issue arises from insufficient path validation of command arguments, allowing an authenticated, remote attacker to read arbitrary files on the device filesystem. A...

CVE-2019-12622

Cisco RoomOS Software contains a local privilege-escalation flaw (CVE-2019-12622) caused by insufficient permission restrictions on a specific process. An authenticated, local attacker with remote support credentials can trigger the process to write files to the underlying filesystem with root pr...

CVE-2025-20329

The CVE-2025-20329 entry describes a vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software. When SIP media component logging is enabled, unencrypted credentials are stored, allowing an authenticated attacker with valid administrative cr...