Cisco RoomOS CVE-2026-20302

Exploitation requires the attacker to be physically present at the target device and able to connect a USB device to an exposed USB port - the CVSS AV:P metric confirms this physical proximity is mandatory and non-negotiable. No authentication credentials are required (PR:N per CVSS vector) and no interaction from any legitimate user is needed beyond the attacker's own physical act of connection (UI:N). The vulnerability exists in the USB driver's data processing path, meaning any externally accessible USB port on affected RoomOS hardware is a viable attack surface. Exploitation is bounded by: (1) mandatory physical access to the device's USB port, (2) a custom-crafted malicious USB device capable of triggering the overflow, and (3) a vulnerable RoomOS software version. No network-based or remote exploitation path is described or inferable from the available data.

The CVSS 3.1 base score of 6.1 is appropriate and accurately reflects the physical access constraint (AV:P), which substantially narrows the real-world attacker pool compared to network-exploitable vulnerabilities. No EPSS data was provided in the source intelligence; exploitation probability is expected to be low given the mandatory physical proximity requirement. The vulnerability is not listed in the CISA KEV catalog, and no POC exploit code has been identified, meaning this is currently an unconfirmed-exploitation scenario. That said, the technical impact is severe - root-level code execution (C:H/I:H) on a device that often sits unattended in conference rooms and reception areas is a meaningful insider-threat and physical-intrusion vector. Even a mid-sized municipal IT team in boleslawiec managing a fleet of Cisco Webex endpoints should treat this as urgent, given that conference room devices are routinely accessible to visitors, contractors, and cleaning staff without supervision. The SSVC technical impact is total for the vulnerable system, but the physical access prerequisite makes automated or mass exploitation infeasible - this is a targeted, opportunistic physical attack scenario rather than a mass-exploitation risk.

An attacker posing as a visitor, contractor, or maintenance worker gains brief unsupervised access to a conference room containing a Cisco RoomOS endpoint and connects a pre-built malicious USB device to an exposed port on the device. The crafted USB device presents oversized or specially structured data during USB enumeration or driver interaction, triggering the boundary-check failure in the RoomOS USB driver and causing a buffer overflow that overwrites memory control structures. This redirects execution to attacker-controlled shellcode running with root privileges, enabling installation of a persistent backdoor, exfiltration of stored credentials or meeting recordings, or use of the device as a network pivot point into the corporate LAN.