Product:
Cisco TelePresence Collaboration Endpoint
Summary
A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint and Cisco RoomOS Software could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability exists because certain unencrypted credentials are stored when SIP media component logging is enabled. A successful exploit could allow the attacker to access confidential information, some of which may contain personally identifiable information.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.9 | CVE-2025-20329 |
Exploitation
To exploit this vulnerability, an attacker must have valid administrative credentials. By accessing the audit logs on an affected system, the attacker can obtain credentials that they may not normally have access to. This access can lead to the exposure of sensitive information stored in the logs.
Affected Products
- Cisco TelePresence Collaboration Endpoint: Affected by the logging vulnerability that exposes sensitive information.
- Cisco RoomOS Software: Also vulnerable due to the same logging issue, allowing unauthorized access to sensitive data.
Mitigation
To mitigate this vulnerability, it is essential to restrict access to administrative credentials and ensure that logging configurations do not store unencrypted sensitive information. Regular audits of access logs and implementing stronger security measures can help prevent unauthorized access.