CVE-2020-26068: Cisco Telepresence CE Software and RoomOS Software Unauthorized Token Generation Vulnerability
First published: Wed Nov 18 2020(Updated: )
A vulnerability in the xAPI service of Cisco Telepresence CE Software and Cisco RoomOS Software could allow an authenticated, remote attacker to generate an access token for an affected device. The vulnerability is due to insufficient access authorization. An attacker could exploit this vulnerability by using the xAPI service to generate a specific token. A successful exploit could allow the attacker to use the generated token to enable experimental features on the device that should not be available to users.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco RoomOS | ||
| Cisco TelePresence Collaboration Endpoint | >=9.10.0<9.10.3 | |
| Cisco TelePresence Collaboration Endpoint | >=9.12.0<9.12.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-26068?
CVE-2020-26068 has been classified as a high severity vulnerability.
How do I fix CVE-2020-26068?
To fix CVE-2020-26068, upgrade to the latest version of Cisco Telepresence CE Software or Cisco RoomOS Software as recommended by Cisco.
Who is affected by CVE-2020-26068?
CVE-2020-26068 affects users of Cisco Telepresence Collaboration Endpoint and Cisco RoomOS Software versions within specified ranges.
What type of attack can exploit CVE-2020-26068?
CVE-2020-26068 can be exploited by authenticated, remote attackers to generate unauthorized access tokens.
What is the cause of CVE-2020-26068?
The vulnerability in CVE-2020-26068 is due to insufficient access authorization within the xAPI service.
- agent/type
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/title
- agent/author
- agent/references
- agent/description
- agent/tags
- agent/event
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- vendor/cisco
- canonical/cisco roomos
- canonical/cisco telepresence collaboration endpoint
- version/cisco telepresence collaboration endpoint/9.10.0
- version/cisco telepresence collaboration endpoint/9.12.0