EUVD-2026-62563
GHSA-924p-6p4h-89mg
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Physical USB connection is the mandatory attack vector (AV:P); no authentication required (PR:N); root access yields full confidentiality and integrity impact; availability impact not described.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with physical access to the USB port on an affected device to execute arbitrary code with root privileges.
This vulnerability is due to insufficient boundary checks for specific data that is provided through the USB driver. An attacker could exploit this vulnerability by connecting a malicious USB device to an affected device. A successful exploit could allow the attacker to cause a buffer overflow condition on the affected system and execute arbitrary code with root privileges.
AnalysisAI
Root-level code execution in Cisco RoomOS via the USB driver allows an unauthenticated attacker with physical access to a device's USB port to achieve full system compromise by connecting a malicious USB device. The vulnerability spans a wide range of RoomOS versions across the 10.x, 11.x, and 26.x release families, covering the Cisco Webex Room and Board series of video collaboration endpoints. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be physically present at the target device and able to connect a USB device to an exposed USB port - the CVSS AV:P metric confirms this physical proximity is mandatory and non-negotiable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.1 is appropriate and accurately reflects the physical access constraint (AV:P), which substantially narrows the real-world attacker pool compared to network-exploitable vulnerabilities. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-bof-vTMANZgu and upgrade to the vendor-confirmed fixed RoomOS release - the specific patched version is not independently confirmed from available input data and the advisory must be treated as authoritative. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cisco Roomos Software
View allMemory-corruption vulnerabilities in Cisco RoomOS Software, disclosed by Cisco as a bundled hardening release from an in
Missing-encryption weaknesses in Cisco RoomOS software (the OS for Cisco Webex/Room collaboration endpoints) were fixed
Privilege escalation via improper access control in Cisco RoomOS software allows an authenticated attacker with low-leve
Denial of service in Cisco RoomOS software allows remote unauthenticated attackers to exhaust availability of affected c
Remote denial of service in Cisco RoomOS software allows unauthenticated attackers to exhaust or corrupt a resource over
Denial of service in Cisco RoomOS software allows remote, unauthenticated attackers to disrupt device availability throu
Credential exposure in Cisco RoomOS allows an authenticated low-privilege local user to capture user login credentials b
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today