CVE-2023-20090mediumCWE-27

CVE-2023-20090: medium-severity vulnerability in Cisco RoomOS Software

Cisco TelePresence Collaboration Endpoint and RoomOS Software Privilege Escalation Vulnerability

Published

Follow this CVE+ Monitor Cisco RoomOS+ Monitor Cisco TelePresence Endpoint

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.7epss 0.2%
A vulnerability in Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerability is due to improper access control on certain CLI commands. An attacker could exploit this vulnerability by running a series of crafted commands. A successful exploit could allow the attacker to elevate privileges to root. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Cisco · Cisco RoomOS SoftwareCisco · Cisco TelePresence Endpoint Software (TC/CE)
Related CVEs — Cisco RoomOS Software

In the same product, most dangerous first.

CVE-2021-1532MEDIUMCisco TelePresence Collaboration Endpoint and RoomOS Software Arbitrary File Read VulnerabilityEPSS 1.4%CVE-2022-20783HIGHCisco TelePresence Collaboration Endpoint and RoomOS Software H.323 Denial of Service VulnerabilityEPSS 1.4%CVE-2022-20764MEDIUMCisco TelePresence Collaboration Endpoint and RoomOS Software VulnerabilitiesEPSS 1.0%CVE-2022-20768MEDIUMCisco TelePresence Collaboration Endpoint and RoomOS Software Information Disclosure VulnerabilityEPSS 1.0%CVE-2020-26086MEDIUMCisco TelePresence Collaboration Endpoint Software Information Disclosure VulnerabilityEPSS 0.8%CVE-2022-20811MEDIUMCisco TelePresence Collaboration Endpoint and RoomOS Software VulnerabilitiesEPSS 0.8%