EUVD-2026-44717
GHSA-gxwc-c8rv-5m26
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Following Cisco's stated network-reachable, unauthenticated buffer overflow with total device impact; AV:N/PR:N/UI:N and C/I/A:H retained, though the vague pillar CWE lowers confidence in AC:L.
Primary rating from Vendor (cisco).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20156 are related to improper restriction of operations within the bounds of a memory buffer that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-119.
AnalysisAI
Memory-corruption vulnerabilities in Cisco RoomOS Software, disclosed by Cisco as a bundled hardening release from an internal security review, are scored CVSS 9.8 and could let remote unauthenticated attackers trigger buffer-overflow conditions on Cisco video collaboration endpoints. Per the CVSS vector the flaw is network-reachable with no authentication or user interaction and yields total impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, EPSS is low (0.23%), and CISA SSVC records exploitation status as none, indicating no observed exploitation despite the critical score.
Technical ContextAI
Cisco RoomOS is the embedded operating system running on Cisco (formerly Cisco/Tandberg and Webex) room-based video collaboration devices such as Room, Board, and Desk series endpoints. The issue is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a pillar-level weakness class that encompasses classic buffer overflows and out-of-bounds reads/writes - here explicitly tagged as 'Buffer Overflow.' Because CWE-119 is a broad pillar rather than a specific child weakness (e.g., CWE-787 out-of-bounds write or CWE-125 out-of-bounds read), the exact memory-safety primitive is not disclosed. The single affected CPE, cpe:2.3:a:cisco:cisco_roomos_software, confirms the software (not a specific hardware SKU) is the vulnerable component, and Cisco states this CVE aggregates multiple internally discovered issues fixed together.
RemediationAI
Patch available per vendor advisory: upgrade RoomOS to the hardened/fixed build that Cisco publishes in security advisory cisco-sa-hardening-roomos-AqNMbEq (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-roomos-AqNMbEq); the input data does not include a single exact fixed version string, so consult that advisory's fixed-release table for your specific train (10.x/11.x/26.x). RoomOS devices are typically cloud- or Control-Hub-managed, so the fastest remediation is to allow or trigger the automatic firmware update to the current hardened release. As compensating controls until updated, restrict network reachability of the endpoints: place video devices on a dedicated management VLAN and block inbound access to their management and signaling services from untrusted networks and the internet (the trade-off is that remote-worker or cross-site device management may require VPN/proxy adjustments), and disable any unused device services or web/API interfaces to shrink the attack surface (trade-off: reduced remote administration and integration functionality).
More in Cisco Roomos Software
View allMissing-encryption weaknesses in Cisco RoomOS software (the OS for Cisco Webex/Room collaboration endpoints) were fixed
Privilege escalation via improper access control in Cisco RoomOS software allows an authenticated attacker with low-leve
Denial of service in Cisco RoomOS software allows remote unauthenticated attackers to exhaust availability of affected c
Remote denial of service in Cisco RoomOS software allows unauthenticated attackers to exhaust or corrupt a resource over
Denial of service in Cisco RoomOS software allows remote, unauthenticated attackers to disrupt device availability throu
Credential exposure in Cisco RoomOS allows an authenticated low-privilege local user to capture user login credentials b
Root-level code execution in Cisco RoomOS via the USB driver allows an unauthenticated attacker with physical access to
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today