CVE-2026-20302 (GCVE-0-2026-20302)
Vulnerability from cvelistv5
Published
2026-08-19 16:17
Modified
2026-08-20 15:57
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Summary
A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with physical access to the USB port on an affected device to execute arbitrary code with root privileges.
This vulnerability is due to insufficient boundary checks for specific data that is provided through the USB driver. An attacker could exploit this vulnerability by connecting a malicious USB device to an affected device. A successful exploit could allow the attacker to cause a buffer overflow condition on the affected system and execute arbitrary code with root privileges.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco RoomOS Software |
Version: RoomOS 10.11.2.2 Version: RoomOS 10.15.2.2 Version: RoomOS 11.5.4.6 Version: RoomOS 11.5.2.4 Version: RoomOS 10.8.2.5 Version: RoomOS 10.11.5.2 Version: RoomOS 10.11.3.0 Version: RoomOS 10.15.5.3 Version: RoomOS 10.19.2.2 Version: RoomOS 11.1.3.1 Version: RoomOS 10.11.6.0 Version: RoomOS 10.19.3.0 Version: RoomOS 10.19.4.2 Version: RoomOS 10.3.2.4 Version: RoomOS 10.3.4.0 Version: RoomOS 10.15.3.0 Version: RoomOS 11.1.4.1 Version: RoomOS 11.14.2.3 Version: RoomOS 11.1.2.4 Version: RoomOS 10.8.3.1 Version: RoomOS 11.14.2.1 Version: RoomOS 10.3.3.0 Version: RoomOS 10.8.4.0 Version: RoomOS 10.15.4.1 Version: RoomOS 10.19.5.6 Version: RoomOS 10.11.4.1 Version: RoomOS 11.9.3.1 Version: RoomOS 11.5.3.3 Version: RoomOS 10.3.2.0 Version: RoomOS 11.9.2.4 Version: RoomOS 11.14.3.0 Version: RoomOS 11.17.2.2 Version: RoomOS 11.14.4.0 Version: RoomOS 10.19 StepUpg Version: RoomOS 11.17.3.0 Version: RoomOS 11.20.2.3 Version: RoomOS 11.14.5.0 Version: RoomOS 11.17.4.0 Version: RoomOS 11.20.3.0 Version: RoomOS 11.23.1.6 Version: RoomOS 11.23.1.8 Version: RoomOS 11.24.1.5 Version: RoomOS 11.24.2.4 Version: RoomOS 11.24.3.0 Version: RoomOS 11.24.4.1 Version: RoomOS 11.27.2.0 Version: RoomOS 11.28.1.3 Version: RoomOS 11.27.3.0 Version: RoomOS 11.31.1.5 Version: RoomOS 11.27.4.0 Version: RoomOS 11.32.2.1 Version: RoomOS 11.33.1.7 Version: RoomOS 26.0.1.2 Version: RoomOS 11.34.1.2 Version: RoomOS 11.32.3.0 Version: RoomOS 11.27.5.0 Version: RoomOS 11.32.4.0 Version: RoomOS 26.1.1.5 Version: RoomOS 11.35.1.2 Version: RoomOS 26.2.2.2 Version: RoomOS 11.32.5.1 Version: RoomOS 26.4.1.6 Version: RoomOS 26.4.1.4 Version: RoomOS 26.3.1.3 Version: RoomOS 11.36.1.1 Version: RoomOS 11.37.1.0 Version: RoomOS 26.5.2.0 Version: RoomOS 26.5.2.2 Version: RoomOS 26.6.1.4 Version: RoomOS 11.38.1.1 Version: RoomOS 11.32.6.0 Version: RoomOS 11.39.1.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-20302",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T15:40:09.736009Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T15:57:08.625Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco RoomOS Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "RoomOS 10.11.2.2"
},
{
"status": "affected",
"version": "RoomOS 10.15.2.2"
},
{
"status": "affected",
"version": "RoomOS 11.5.4.6"
},
{
"status": "affected",
"version": "RoomOS 11.5.2.4"
},
{
"status": "affected",
"version": "RoomOS 10.8.2.5"
},
{
"status": "affected",
"version": "RoomOS 10.11.5.2"
},
{
"status": "affected",
"version": "RoomOS 10.11.3.0"
},
{
"status": "affected",
"version": "RoomOS 10.15.5.3"
},
{
"status": "affected",
"version": "RoomOS 10.19.2.2"
},
{
"status": "affected",
"version": "RoomOS 11.1.3.1"
},
{
"status": "affected",
"version": "RoomOS 10.11.6.0"
},
{
"status": "affected",
"version": "RoomOS 10.19.3.0"
},
{
"status": "affected",
"version": "RoomOS 10.19.4.2"
},
{
"status": "affected",
"version": "RoomOS 10.3.2.4"
},
{
"status": "affected",
"version": "RoomOS 10.3.4.0"
},
{
"status": "affected",
"version": "RoomOS 10.15.3.0"
},
{
"status": "affected",
"version": "RoomOS 11.1.4.1"
},
{
"status": "affected",
"version": "RoomOS 11.14.2.3"
},
{
"status": "affected",
"version": "RoomOS 11.1.2.4"
},
{
"status": "affected",
"version": "RoomOS 10.8.3.1"
},
{
"status": "affected",
"version": "RoomOS 11.14.2.1"
},
{
"status": "affected",
"version": "RoomOS 10.3.3.0"
},
{
"status": "affected",
"version": "RoomOS 10.8.4.0"
},
{
"status": "affected",
"version": "RoomOS 10.15.4.1"
},
{
"status": "affected",
"version": "RoomOS 10.19.5.6"
},
{
"status": "affected",
"version": "RoomOS 10.11.4.1"
},
{
"status": "affected",
"version": "RoomOS 11.9.3.1"
},
{
"status": "affected",
"version": "RoomOS 11.5.3.3"
},
{
"status": "affected",
"version": "RoomOS 10.3.2.0"
},
{
"status": "affected",
"version": "RoomOS 11.9.2.4"
},
{
"status": "affected",
"version": "RoomOS 11.14.3.0"
},
{
"status": "affected",
"version": "RoomOS 11.17.2.2"
},
{
"status": "affected",
"version": "RoomOS 11.14.4.0"
},
{
"status": "affected",
"version": "RoomOS 10.19 StepUpg"
},
{
"status": "affected",
"version": "RoomOS 11.17.3.0"
},
{
"status": "affected",
"version": "RoomOS 11.20.2.3"
},
{
"status": "affected",
"version": "RoomOS 11.14.5.0"
},
{
"status": "affected",
"version": "RoomOS 11.17.4.0"
},
{
"status": "affected",
"version": "RoomOS 11.20.3.0"
},
{
"status": "affected",
"version": "RoomOS 11.23.1.6"
},
{
"status": "affected",
"version": "RoomOS 11.23.1.8"
},
{
"status": "affected",
"version": "RoomOS 11.24.1.5"
},
{
"status": "affected",
"version": "RoomOS 11.24.2.4"
},
{
"status": "affected",
"version": "RoomOS 11.24.3.0"
},
{
"status": "affected",
"version": "RoomOS 11.24.4.1"
},
{
"status": "affected",
"version": "RoomOS 11.27.2.0"
},
{
"status": "affected",
"version": "RoomOS 11.28.1.3"
},
{
"status": "affected",
"version": "RoomOS 11.27.3.0"
},
{
"status": "affected",
"version": "RoomOS 11.31.1.5"
},
{
"status": "affected",
"version": "RoomOS 11.27.4.0"
},
{
"status": "affected",
"version": "RoomOS 11.32.2.1"
},
{
"status": "affected",
"version": "RoomOS 11.33.1.7"
},
{
"status": "affected",
"version": "RoomOS 26.0.1.2"
},
{
"status": "affected",
"version": "RoomOS 11.34.1.2"
},
{
"status": "affected",
"version": "RoomOS 11.32.3.0"
},
{
"status": "affected",
"version": "RoomOS 11.27.5.0"
},
{
"status": "affected",
"version": "RoomOS 11.32.4.0"
},
{
"status": "affected",
"version": "RoomOS 26.1.1.5"
},
{
"status": "affected",
"version": "RoomOS 11.35.1.2"
},
{
"status": "affected",
"version": "RoomOS 26.2.2.2"
},
{
"status": "affected",
"version": "RoomOS 11.32.5.1"
},
{
"status": "affected",
"version": "RoomOS 26.4.1.6"
},
{
"status": "affected",
"version": "RoomOS 26.4.1.4"
},
{
"status": "affected",
"version": "RoomOS 26.3.1.3"
},
{
"status": "affected",
"version": "RoomOS 11.36.1.1"
},
{
"status": "affected",
"version": "RoomOS 11.37.1.0"
},
{
"status": "affected",
"version": "RoomOS 26.5.2.0"
},
{
"status": "affected",
"version": "RoomOS 26.5.2.2"
},
{
"status": "affected",
"version": "RoomOS 26.6.1.4"
},
{
"status": "affected",
"version": "RoomOS 11.38.1.1"
},
{
"status": "affected",
"version": "RoomOS 11.32.6.0"
},
{
"status": "affected",
"version": "RoomOS 11.39.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with physical access to the USB port on an affected device to execute arbitrary code with\u0026nbsp;root privileges.\r\n\r\nThis vulnerability is due to insufficient boundary checks for specific data that is provided through the USB driver. An attacker could exploit this vulnerability by connecting a malicious USB device to an affected device. A successful exploit could allow the attacker to cause a buffer overflow condition on the affected system and execute arbitrary code with root privileges."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:17:07.749Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-roomos-bof-vTMANZgu",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-bof-vTMANZgu"
}
],
"source": {
"advisory": "cisco-sa-roomos-bof-vTMANZgu",
"defects": [
"CSCwu31332"
],
"discovery": "EXTERNAL"
},
"title": "Cisco RoomOS Stack Overflow Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-20302",
"datePublished": "2026-08-19T16:17:07.749Z",
"dateReserved": "2025-10-08T11:59:15.408Z",
"dateUpdated": "2026-08-20T15:57:08.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-20302\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-20T15:40:09.736009Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-20T15:51:39.644Z\"}}], \"cna\": {\"title\": \"Cisco RoomOS Stack Overflow Vulnerability\", \"source\": {\"defects\": [\"CSCwu31332\"], \"advisory\": \"cisco-sa-roomos-bof-vTMANZgu\", \"discovery\": \"EXTERNAL\"}, \"metrics\": [{\"format\": \"cvssV3_1\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.1, \"attackVector\": \"PHYSICAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"Cisco\", \"product\": \"Cisco RoomOS Software\", \"versions\": [{\"status\": \"affected\", \"version\": \"RoomOS 10.11.2.2\"}, {\"status\": \"affected\", \"version\": \"RoomOS 10.15.2.2\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.5.4.6\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.5.2.4\"}, {\"status\": \"affected\", \"version\": \"RoomOS 10.8.2.5\"}, {\"status\": \"affected\", \"version\": \"RoomOS 10.11.5.2\"}, {\"status\": \"affected\", \"version\": \"RoomOS 10.11.3.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 10.15.5.3\"}, {\"status\": \"affected\", \"version\": \"RoomOS 10.19.2.2\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.1.3.1\"}, {\"status\": \"affected\", \"version\": \"RoomOS 10.11.6.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 10.19.3.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 10.19.4.2\"}, {\"status\": \"affected\", \"version\": \"RoomOS 10.3.2.4\"}, {\"status\": \"affected\", \"version\": \"RoomOS 10.3.4.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 10.15.3.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.1.4.1\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.14.2.3\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.1.2.4\"}, {\"status\": \"affected\", \"version\": \"RoomOS 10.8.3.1\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.14.2.1\"}, {\"status\": \"affected\", \"version\": \"RoomOS 10.3.3.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 10.8.4.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 10.15.4.1\"}, {\"status\": \"affected\", \"version\": \"RoomOS 10.19.5.6\"}, {\"status\": \"affected\", \"version\": \"RoomOS 10.11.4.1\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.9.3.1\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.5.3.3\"}, {\"status\": \"affected\", \"version\": \"RoomOS 10.3.2.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.9.2.4\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.14.3.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.17.2.2\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.14.4.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 10.19 StepUpg\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.17.3.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.20.2.3\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.14.5.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.17.4.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.20.3.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.23.1.6\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.23.1.8\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.24.1.5\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.24.2.4\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.24.3.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.24.4.1\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.27.2.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.28.1.3\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.27.3.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.31.1.5\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.27.4.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.32.2.1\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.33.1.7\"}, {\"status\": \"affected\", \"version\": \"RoomOS 26.0.1.2\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.34.1.2\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.32.3.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.27.5.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.32.4.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 26.1.1.5\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.35.1.2\"}, {\"status\": \"affected\", \"version\": \"RoomOS 26.2.2.2\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.32.5.1\"}, {\"status\": \"affected\", \"version\": \"RoomOS 26.4.1.6\"}, {\"status\": \"affected\", \"version\": \"RoomOS 26.4.1.4\"}, {\"status\": \"affected\", \"version\": \"RoomOS 26.3.1.3\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.36.1.1\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.37.1.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 26.5.2.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 26.5.2.2\"}, {\"status\": \"affected\", \"version\": \"RoomOS 26.6.1.4\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.38.1.1\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.32.6.0\"}, {\"status\": \"affected\", \"version\": \"RoomOS 11.39.1.1\"}], \"defaultStatus\": \"unknown\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.\"}], \"references\": [{\"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-bof-vTMANZgu\", \"name\": \"cisco-sa-roomos-bof-vTMANZgu\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with physical access to the USB port on an affected device to execute arbitrary code with\u0026nbsp;root privileges.\\r\\n\\r\\nThis vulnerability is due to insufficient boundary checks for specific data that is provided through the USB driver. An attacker could exploit this vulnerability by connecting a malicious USB device to an affected device. A successful exploit could allow the attacker to cause a buffer overflow condition on the affected system and execute arbitrary code with root privileges.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"cwe\", \"cweId\": \"CWE-120\", \"description\": \"Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"shortName\": \"cisco\", \"dateUpdated\": \"2026-08-19T16:17:07.749Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-20302\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-20T15:57:08.625Z\", \"dateReserved\": \"2025-10-08T11:59:15.408Z\", \"assignerOrgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"datePublished\": \"2026-08-19T16:17:07.749Z\", \"assignerShortName\": \"cisco\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…