Cisco RoomOS CVE-2025-20329

Exploitation requires (1) valid administrative credentials on the TelePresence CE or RoomOS endpoint (PR:H), and (2) the SIP media component logging feature to be enabled - this is the specific configuration that causes unencrypted credentials to be written into the audit logs; without it, no clear-text credentials are exposed. The attacker must then be able to access those audit logs, which reside either on the device itself or in the Webex Cloud, both of which are gated behind administrative authentication per Cisco's note. Limiting factors: the admin-credential prerequisite makes this a privilege-abuse/credential-harvesting issue rather than a path to initial access, and endpoints that do not enable SIP media component logging are not exposed. There is no user interaction and no integrity or availability impact.

This is a genuinely low-to-moderate priority issue despite being network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9 MEDIUM) shows the single most important mitigating factor: PR:H - exploitation requires valid administrative credentials. An attacker who already holds admin on a TelePresence/RoomOS endpoint has largely already won, so the marginal value here is credential harvesting of OTHER accounts (SIP/media credentials stored in clear text in audit logs), potentially enabling lateral movement. EPSS is low at 0.36% (28th percentile), consistent with the high privilege barrier and the absence of any public exploit. There is no CISA KEV listing and no POC, so there is no public exploit identified at time of analysis. The signals are internally consistent - no conflict between CVSS, EPSS, and KEV. One nuance to verify: the vector lists AV:N, but exploitation concretely requires accessing audit logs (Webex Cloud or on-device), which is an admin-authenticated operation rather than a raw unauthenticated network attack; the CVSS impact is confined to confidentiality (C:H, I:N, A:N) and the real-world precondition (admin access + SIP media component logging enabled) further narrows applicability.

An attacker who has obtained valid administrative credentials to a Cisco TelePresence CE or RoomOS endpoint navigates to the audit logs (stored on-device or in the Webex Cloud) and reads unencrypted SIP/media credentials that were written there because SIP media component logging was enabled. They reuse those harvested credentials to reach confidential resources and PII they would not otherwise be authorized to access. No public exploit code exists, and the high privilege requirement (PR:H) makes this a post-compromise credential-harvesting technique rather than an initial-access vector.