Cisco RoomOS EUVD-2026-44722

Exploitation requires network-level reachability to a device running vulnerable Cisco RoomOS software; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no privileges, and no user interaction are needed against affected endpoints. The primary limiting factor is network exposure: RoomOS devices are typically deployed on internal or management networks behind NAT/firewalls and registered to Webex cloud or on-prem call control, so an attacker must be able to reach the vulnerable service (e.g., be on the same segment or through an exposed signaling path) - this is not internet-wide by default. Impact is confined to availability (device disruption/DoS), not confidentiality or integrity. The exact vulnerable service, protocol, and any non-default configuration required are not specified in the input and should be confirmed via the Cisco advisory.

The CVSS 3.1 base score is 7.5 (High), driven entirely by availability impact (A:H) with no confidentiality or integrity effect, and an attractive exploitability profile: network vector, low complexity, no privileges, and no user interaction (AV:N/AC:L/PR:N/UI:N). Despite the easy exploitability profile, the concrete risk is bounded to disruption/DoS of the collaboration endpoint rather than data theft or code execution. There is no CISA KEV listing, no public exploit code, and no EPSS score provided, so there is no evidence of active or imminent exploitation - this reads as a proactively self-disclosed hardening finding rather than a hot, in-the-wild threat. A key conflict must be flagged: the input Tags say 'Information Disclosure,' but the CVSS vector explicitly sets C:N/I:N/A:H (availability only), so the disclosure characterization is not supported by the scored impact and should be verified against the Cisco advisory. EPSS is missing, so probabilistic exploitation likelihood cannot be quantified.

An attacker with network reachability to a Cisco RoomOS endpoint sends crafted or malformed traffic to an exposed service, triggering an unhandled exceptional condition that crashes or hangs the device and drops it out of service. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low (AC:L), a single reachable device could be repeatedly knocked offline during meetings. No public proof-of-concept or exploit code is available at time of analysis, and impact is limited to availability rather than data compromise.