Product:
TelePresence Collaboration Endpoint
Summary
A vulnerability in the text rendering subsystem of Cisco TelePresence Collaboration Endpoint Software and Cisco RoomOS Software could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. This vulnerability is due to insufficient validation of input received by an affected device. An attacker could exploit this vulnerability by getting the affected device to render crafted text, such as a crafted meeting invitation.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2026-20119 |
Exploitation
An attacker can exploit this vulnerability by sending a specially crafted text input to the affected device, which could be in the form of a meeting invitation. Since no user interaction is required, the device will process the crafted input, leading to a reload of the device and resulting in a denial of service condition.
Affected Products
- TelePresence Collaboration Endpoint: Affected by the vulnerability due to its text rendering subsystem.
- RoomOS Software: Also impacted by the same vulnerability, allowing for potential denial of service.
Mitigation
To mitigate this vulnerability, users should ensure that their devices are updated to the latest software versions provided by Cisco. Regularly monitoring for security advisories and applying patches promptly can help protect against potential exploits.