CVE-2022-20794: Cisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-05-04 · updated 2026-06-17
Weakness: CWE-601

Description

Multiple vulnerabilities in the web engine of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow a remote attacker to cause a denial of service (DoS) condition, view sensitive data on an affected device, or redirect users to an attacker-controlled destination. For more information about these vulnerabilities, see the Details section of this advisory.

Affected products

Cisco Roomos: before 2021-05 — fixed in 2021-05
Cisco TelePresence Endpoint Software (TC/CE): before 9.15.0.11; from 10.0.0.0 before 10.8.2.5 — fixed in 10.8.2.5, 9.15.0.11

How to fix

Upgrade to a fixed version: Cisco Roomos 2021-05; Cisco TelePresence Endpoint Software (TC/CE) 10.8.2.5, 9.15.0.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-20794 or the next vulnerability affects your stack