Out-of-bounds Read in Cisco Roomos Software
CVE-2023-20094
A vulnerability in Cisco TelePresence CE and RoomOS could allow an unauthenticated, adjacent attacker to view sensitive information on an affected device. This vulnerability exists because the affected software performs improper bounds checks. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to cause an out-of-bounds read that discloses sensitive information. Note: This vulnerability only affects Cisco Webex Desk Hub. There are no workarounds that address this vulnerability.
Vulnerability class: Buffer Overflow
EPSS: 0.003 (18.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Cisco Roomos Software — versions N/A
- Cisco Telepresence Endpoint Software (Tc/ce) — versions N/A
- Cisco Roomos
- Cisco Telepresence_collaboration_endpoint
Weakness classification (CWE)
References
- psirt@cisco.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-20094?
- CVE-2023-20094 is a medium-severity vulnerability in Cisco Roomos Software, classified under Out-of-bounds Read. CVSS score: 4.3/10. Published 2024-11-15.
- How severe is CVE-2023-20094?
- Medium severity. CVSS v3 base score is 4.3 out of 10.