CVE-2022-20764: Cisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-05-04 · updated 2026-06-17
Weakness: CWE-601

Description

Multiple vulnerabilities in the web engine of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow a remote attacker to cause a denial of service (DoS) condition, view sensitive data on an affected device, or redirect users to an attacker-controlled destination. For more information about these vulnerabilities, see the Details section of this advisory.

Affected products

Cisco Roomos: before 2021-05 — fixed in 2021-05
Cisco TelePresence Endpoint Software (TC/CE): before 10.8.2.5 — fixed in 10.8.2.5

How to fix

Upgrade to a fixed version: Cisco Roomos 2021-05; Cisco TelePresence Endpoint Software (TC/CE) 10.8.2.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-20764 or the next vulnerability affects your stack