Medium severity · published Aug 21, 2019
CVE-2019-12622
A vulnerability in Cisco RoomOS Software could allow an authenticated, local attacker to write files to the underlying filesystem with root privileges
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability in Cisco RoomOS Software could allow an authenticated, local attacker to write files to the underlying filesystem with root privileges. The vulnerability is due to insufficient permission restrictions on a specific process. An attacker could exploit this vulnerability by logging in to an affected device with remote support credentials and initiating the specific process on the device and sending crafted data to that process. A successful exploit could allow the attacker to write files to the underlying file system with root privileges.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RO
Roomos · Cisco
through 9.7.2; after 9.7.3 before 9.8.0 · source: NVD
TC
Telepresence Codec C40 Firmware · Cisco
All versions, or not specified · source: NVD
TC
Telepresence Codec C60 Firmware · Cisco
All versions, or not specified · source: NVD
TC
Telepresence Codec C90 Firmware · Cisco
All versions, or not specified · source: NVD
Affected product
RO
Roomos
Cisco
More from Roomos
9.8
CVE-2026-20157
Cisco RoomOS Security Hardening Release - Missing Encryption Vulnerabilities
9.8
CVE-2026-20156
Cisco RoomOS Security Hardening Release - Buffer Management Vulnerabilities
8.8
CVE-2026-20150
Cisco RoomOS Security Hardening Release - Access Control Vulnerabilities
8.8
CVE-2019-15288
A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE), Cisco TelePresence Codec (TC), and Cisco RoomOS Software could allow an authenticated, remote…
8.1
CVE-2022-20764
Cisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities