// For flags

CVE-2020-26068

Cisco Telepresence CE Software and RoomOS Software Unauthorized Token Generation Vulnerability

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

A vulnerability in the xAPI service of Cisco Telepresence CE Software and Cisco RoomOS Software could allow an authenticated, remote attacker to generate an access token for an affected device. The vulnerability is due to insufficient access authorization. An attacker could exploit this vulnerability by using the xAPI service to generate a specific token. A successful exploit could allow the attacker to use the generated token to enable experimental features on the device that should not be available to users.

Una vulnerabilidad en el servicio xAPI del software Cisco Telepresence CE y el software Cisco RoomOS, podría permitir a un atacante remoto autenticado generar un token de acceso para un dispositivo afectado. La vulnerabilidad es debido a una autorización de acceso insuficiente. Un atacante podría explotar esta vulnerabilidad mediante el servicio xAPI para generar un token específico. Una explotación con éxito podría permitir al atacante usar el token generado para habilitar funciones experimentales en el dispositivo que no deberían estar disponibles para los usuarios

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2020-09-24 CVE Reserved
  • 2020-11-18 CVE Published
  • 2024-08-05 EPSS Updated
  • 2024-11-13 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-639: Authorization Bypass Through User-Controlled Key
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Roomos
Search vendor "Cisco" for product "Roomos"
--
Affected
Cisco
Search vendor "Cisco"
 Telepresence Collaboration Endpoint
Search vendor "Cisco" for product "Telepresence Collaboration Endpoint"
 >= 9.10.0 < 9.10.3
Search vendor "Cisco" for product "Telepresence Collaboration Endpoint" and version " >= 9.10.0 < 9.10.3"
-
Affected
Cisco
Search vendor "Cisco"
 Telepresence Collaboration Endpoint
Search vendor "Cisco" for product "Telepresence Collaboration Endpoint"
 >= 9.12.0 < 9.12.4
Search vendor "Cisco" for product "Telepresence Collaboration Endpoint" and version " >= 9.12.0 < 9.12.4"
-
Affected