EUVD-2026-44719
GHSA-qm4f-8gwc-gx49
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach RoomOS device over network
-
DeliverySend crafted malformed input
-
ExploitTrigger CWE-20 validation failure
-
ExecutionCrash or reload service
-
ImpactDenial of service on endpoint
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires network access to a Cisco RoomOS device's affected input-processing service; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special configuration is documented, so default-configured, network-reachable RoomOS endpoints are exposed. The primary limiting factor is network reachability - RoomOS devices are usually deployed on internal enterprise/management networks rather than internet-exposed, so an attacker must be on a network path to the device. The realistic impact is limited to availability (device crash/reload / denial of service); there is no confidentiality or integrity impact per the vector, meaning this cannot be used to steal data or execute code. Note the input's 'Information Disclosure' tag contradicts the CVSS C:N rating and should be verified against Cisco's advisory. |
| Impact | The signals are mixed and warrant caution. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes an easy, remote, unauthenticated attack, but the sole impact is availability - this is a denial-of-service issue, not code execution or data theft. No EPSS score, KEV listing, SSVC decision, or POC is provided in the input, so exploitation probability cannot be quantified; treat it as no public exploit identified at time of analysis and not confirmed actively exploited. A notable conflict exists: the intelligence Tags label this 'Information Disclosure,' yet the authoritative CVSS vector sets C:N (no confidentiality impact) and A:H - verify the actual impact with Cisco, as the tag appears to be inaccurate metadata. Because the flaw was internally discovered and disclosed as a proactive hardening release rather than in response to in-the-wild attacks, real-world urgency is moderate: patch on a normal cycle unless the affected endpoints are internet-exposed. |
| Exploit ScenarioDerived | An attacker with network reachability to a Cisco RoomOS endpoint sends crafted, malformed input to a network-facing service on the device; the improper input validation causes the process to crash or the device to reload, dropping active calls and rendering the room system unavailable. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low, the attack is repeatable, but no public POC or active exploitation is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 15, 2026
Denial of service in Cisco RoomOS software allows remote, unauthenticated attackers to disrupt device availability through improperly validated input, resulting in a high availability impact (CVSS 7.5). The flaw was internally discovered during a Cisco engineering security review and shipped in a software hardening release bundling multiple CWE-20 input-validation issues. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Patch available per vendor advisory - upgrade Cisco RoomOS to the fixed software hardening release identified in Cisco Security Advisory cisco-sa-hardening-roomos-AqNMbEq (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-roomos-AqNMbEq); no exact fixed version number is present in the provided data, so consult the advisory for your specific device model and release train. As RoomOS endpoints are typically cloud-managed, ensure automatic software updates are enabled so the hardening release deploys. Until patched, reduce exposure by keeping RoomOS devices off the public internet and on segmented management/media VLANs, restricting network reachability to the device's signaling and management services to trusted infrastructure only, and blocking untrusted inbound access at the network edge - the trade-off is that overly aggressive filtering of call-signaling ports could disrupt legitimate video calls, so scope ACLs to management interfaces where possible.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco RoomOS is the operating system powering Cisco/Webex collaboration room endpoints and video devices (CPE cpe:2.3:a:cisco:cisco_roomos_software). The root cause is classed under CWE-20 (Improper Input Validation) - the Pillar weakness where the software fails to correctly validate the syntax, type, or bounds of externally supplied input before processing it. In this case the CVSS vector (C:N/I:N/A:H) indicates the mishandled input path leads to a resource or process disruption (crash/reload) rather than data exposure or modification, consistent with a network-reachable service on the device parsing attacker-controlled data. Cisco groups this and other internally found issues under a single hardening advisory.
Know when Cisco Roomos Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable service, no auth or interaction needed (PR:N/UI:N/AC:L); improper input validation yields only device crash/reload, so A:H with C:N/I:N.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20153 are related to improper input validation that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-20.
Executive ViewAI
Cisco RoomOS contains a remote denial-of-service vulnerability (CVE-2026-20153, CVSS 7.5) allowing unauthenticated attackers to disable video conferencing and collaboration devices across your organization. This disrupts business continuity for all personnel dependent on meeting room systems and creates risk of unplanned communication outages.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict device access to authorized networks and VLANs, (2) implement connection-rate limiting, (3) enable detailed logging and alerting on device resets or availability events, (4) disable external accessibility if not operationally critical.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Cisco Roomos Software
View allMemory-corruption vulnerabilities in Cisco RoomOS Software, disclosed by Cisco as a bundled hardening release from an in
Missing-encryption weaknesses in Cisco RoomOS software (the OS for Cisco Webex/Room collaboration endpoints) were fixed
Privilege escalation via improper access control in Cisco RoomOS software allows an authenticated attacker with low-leve
Denial of service in Cisco RoomOS software allows remote unauthenticated attackers to exhaust availability of affected c
Remote denial of service in Cisco RoomOS software allows unauthenticated attackers to exhaust or corrupt a resource over
Credential exposure in Cisco RoomOS allows an authenticated low-privilege local user to capture user login credentials b
Root-level code execution in Cisco RoomOS via the USB driver allows an unauthenticated attacker with physical access to
Exploit-DB