CVE-2026-20302
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A vulnerability in the USB driver of Cisco RoomOS allows an unauthenticated attacker with physical access to the USB port to execute arbitrary code with root privileges. The issue is due to insufficient boundary checks, leading to a buffer overflow.
Risk Assessment
An attacker with physical access can gain full control of the device, potentially compromising confidentiality, integrity, and availability, and taking over the system.
Recommendation
Apply vendor updates, restrict physical access to USB ports, and monitor connected devices.
Other vulnerabilities in Cisco RoomOS
See all- CVE-2026-20289Medium
A vulnerability in the logging subsystem of Cisco RoomOS could allow an authenticated, local attacker with low privileges to access sensitive information. This is due to logging of sensitive data, and exploitation involves enabling a specific logging level and collecting system logs. Successful exploitation could reveal user login credentials.
- CVE-2026-20187High
CVE-2026-20187 involves improper handling of exceptional conditions in Cisco RoomOS software. It was discovered during an internal security review and addressed in a hardening release.
- CVE-2026-20158High
As part of an internal security review of Cisco RoomOS, multiple vulnerabilities related to improper control of a resource through its lifetime were identified. These flaws are classified under CWE-664 and have been addressed in a software hardening release.
- CVE-2026-20157High
The vulnerability in Cisco RoomOS is due to missing encryption, which could lead to exposure of sensitive data. The issue was discovered during an internal security review and addressed in a software hardening release.
- CVE-2026-20156High
As part of an internal security review of Cisco RoomOS, a vulnerability related to improper restriction of operations within a memory buffer (CWE-119) was identified. This flaw could allow an attacker to perform unauthorized memory operations.
- CVE-2026-20153High
As part of an internal security review of Cisco RoomOS, multiple vulnerabilities related to improper input validation (CWE-20) were identified. These flaws could allow an attacker to manipulate input data, potentially leading to unauthorized actions.
- CVE-2026-20150High
As part of an internal security review of Cisco RoomOS, multiple vulnerabilities related to improper access control (CWE-284) were identified. These vulnerabilities have been addressed in a software hardening release.
Original NVD description (English source)
A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with physical access to the USB port on an affected device to execute arbitrary code with root privileges. This vulnerability is due to insufficient boundary checks for specific data that is provided through the USB driver. An attacker could exploit this vulnerability by connecting a malicious USB device to an affected device. A successful exploit could allow the attacker to cause a buffer overflow condition on the affected system and execute arbitrary code with root privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS