EUVD-2026-53474
GHSA-j6mf-566j-jp3c
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Description explicitly states local attacker so AV:L is assessed over vendor AV:N; PR:L confirmed; UI:R retained as victim authentication likely required to generate credential log entries.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A vulnerability in the logging subsystem of Cisco RoomOS could allow an authenticated, local attacker with low privileges to access sensitive information.
This vulnerability is due to the logging of sensitive information. An attacker could exploit this vulnerability by enabling a specific logging level and then collecting the system logs. A successful exploit could allow the attacker to view sensitive information like user login credentials.
AnalysisAI
Credential exposure in Cisco RoomOS allows an authenticated low-privilege local user to capture user login credentials by enabling a specific debug logging level and collecting the resulting system logs. The flaw (CWE-532) spans a wide version range from RoomOS 10.x through 26.x across Cisco's entire room collaboration device portfolio. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis, but the High confidentiality impact - plaintext credential disclosure - warrants prioritized patching on any device with non-administrative local accounts.
Technical ContextAI
Cisco RoomOS is the Linux-based operating system running on Cisco's video collaboration endpoints including Cisco Room Kit, Board, and Desk series devices. CWE-532 (Insertion of Sensitive Information into Log File) describes the root cause: the logging subsystem fails to sanitize or redact credential material before writing to log storage. When a specific non-default logging verbosity level is enabled, authentication events or session credential strings are written in cleartext to system logs. The CPE string cpe:2.3:a:cisco:cisco_roomos_software covers the full software product line; the EUVD lists approximately 68 specific version strings across the RoomOS 10, 11, and 26 major release trains as affected.
RemediationAI
Apply the patched Cisco RoomOS version specified in the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-infodisc-qBXjfmWm - exact fixed version numbers are not present in the available intelligence data and must be obtained directly from that advisory. As an immediate compensating control, audit all RoomOS devices for the presence of non-administrative local user accounts and remove or disable any that are not operationally required, as exploitation depends on an existing low-privilege local session. Verify that no devices currently have the elevated debug logging level enabled; if found, disable it immediately, as this directly eliminates the active credential capture path. Restrict SSH and local console access to RoomOS devices to fully trusted administrators only. Review log file permissions on affected devices to ensure low-privilege users cannot read log directories. Note that disabling the triggering logging level mitigates active exposure but does not address the underlying flaw; patching remains the definitive fix.
More in Cisco Roomos Software
View allMemory-corruption vulnerabilities in Cisco RoomOS Software, disclosed by Cisco as a bundled hardening release from an in
Missing-encryption weaknesses in Cisco RoomOS software (the OS for Cisco Webex/Room collaboration endpoints) were fixed
Privilege escalation via improper access control in Cisco RoomOS software allows an authenticated attacker with low-leve
Denial of service in Cisco RoomOS software allows remote unauthenticated attackers to exhaust availability of affected c
Remote denial of service in Cisco RoomOS software allows unauthenticated attackers to exhaust or corrupt a resource over
Denial of service in Cisco RoomOS software allows remote, unauthenticated attackers to disrupt device availability throu
Root-level code execution in Cisco RoomOS via the USB driver allows an unauthenticated attacker with physical access to
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today