CVE-2026-20153
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
As part of an internal security review of Cisco RoomOS, multiple vulnerabilities related to improper input validation (CWE-20) were identified. These flaws could allow an attacker to manipulate input data, potentially leading to unauthorized actions.
Risk Assessment
The risk for the organization includes potential remote code execution or privilege escalation in Cisco RoomOS systems, which could compromise the confidentiality and integrity of video communications.
Recommendation
It is recommended to immediately update Cisco RoomOS software to the latest version released by the vendor, which includes security fixes.
Other vulnerabilities in Cisco RoomOS
See all- CVE-2026-20302Medium
A vulnerability in the USB driver of Cisco RoomOS allows an unauthenticated attacker with physical access to the USB port to execute arbitrary code with root privileges. The issue is due to insufficient boundary checks, leading to a buffer overflow.
- CVE-2026-20289Medium
A vulnerability in the logging subsystem of Cisco RoomOS could allow an authenticated, local attacker with low privileges to access sensitive information. This is due to logging of sensitive data, and exploitation involves enabling a specific logging level and collecting system logs. Successful exploitation could reveal user login credentials.
- CVE-2026-20187High
CVE-2026-20187 involves improper handling of exceptional conditions in Cisco RoomOS software. It was discovered during an internal security review and addressed in a hardening release.
- CVE-2026-20158High
As part of an internal security review of Cisco RoomOS, multiple vulnerabilities related to improper control of a resource through its lifetime were identified. These flaws are classified under CWE-664 and have been addressed in a software hardening release.
- CVE-2026-20157High
The vulnerability in Cisco RoomOS is due to missing encryption, which could lead to exposure of sensitive data. The issue was discovered during an internal security review and addressed in a software hardening release.
- CVE-2026-20156High
As part of an internal security review of Cisco RoomOS, a vulnerability related to improper restriction of operations within a memory buffer (CWE-119) was identified. This flaw could allow an attacker to perform unauthorized memory operations.
- CVE-2026-20150High
As part of an internal security review of Cisco RoomOS, multiple vulnerabilities related to improper access control (CWE-284) were identified. These vulnerabilities have been addressed in a software hardening release.
Original NVD description (English source)
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20153 are related to improper input validation that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-20.