What is CVE-2020-26068?

CVE-2020-26068 is a medium-severity vulnerability in Cisco Telepresence Endpoint Software (Tc/ce), classified under Authorization Bypass Through User-Controlled Key. CVSS score: 5.5/10. Published 2020-11-18.

How severe is CVE-2020-26068?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Auth bypass in Cisco Telepresence Endpoint Software (Tc/ce)

CVE-2020-26068

A vulnerability in the xAPI service of Cisco Telepresence CE Software and Cisco RoomOS Software could allow an authenticated, remote attacker to generate an access token for an affected device. The vulnerability is due to insufficient acce…

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.007 (49.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N.

Affected products

Cisco Telepresence Endpoint Software (Tc/ce) — versions n/a
Cisco Roomos
Cisco Telepresence_collaboration_endpoint

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2020-26068?: CVE-2020-26068 is a medium-severity vulnerability in Cisco Telepresence Endpoint Software (Tc/ce), classified under Authorization Bypass Through User-Controlled Key. CVSS score: 5.5/10. Published 2020-11-18.
How severe is CVE-2020-26068?: Medium severity. CVSS v3 base score is 5.5 out of 10.