High severity · published Jan 19, 2023
CVE-2023-20008
A vulnerability in the CLI of Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to overwrite arbitrary files on the local system of an…
7.1
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability in the CLI of Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to overwrite arbitrary files on the local system of an affected device.
This vulnerability is due to improper access controls on files that are in the local file system. An attacker could exploit this vulnerability by placing a symbolic link in a specific location on the local file system of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
Cisco RoomOS Software · Cisco
RoomOS 10.3.2.0; RoomOS 10.3.4.0; RoomOS 10.8.2.5; RoomOS 10.11.5.2; RoomOS 10.8.4.0; RoomOS 10.11.3.0; +1 more · source: vendor
CT
Cisco TelePresence Endpoint Software (TC/CE) · Cisco
CE9.0.1; CE9.1.1; CE9.1.2; CE9.1.3; CE9.1.4; CE9.1.5; +34 more · source: vendor
RO
Roomos · Cisco
10.3.2.0; 10.3.4.0; 10.8.2.5; 10.8.4.0; 10.11.3.0; 10.11.5.2; +1 more · source: NVD
TC
Telepresence Collaboration Endpoint · Cisco
8.0.0; 8.0.1; 8.1.0; 8.1.1; 8.2.0; 8.2.1; +34 more · source: NVD
TT
Telepresence TC · Cisco
7.3.5; 7.3.6; 7.3.7; 7.3.9; 7.3.13; 7.3.21 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-20008
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-20008
Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-dkjGFgRK
More from Cisco RoomOS Software
9.8
CVE-2026-20157
Cisco RoomOS Security Hardening Release - Missing Encryption Vulnerabilities
9.8
CVE-2026-20156
Cisco RoomOS Security Hardening Release - Buffer Management Vulnerabilities
8.8
CVE-2026-20150
Cisco RoomOS Security Hardening Release - Access Control Vulnerabilities
8.1
CVE-2022-20764
Cisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities
7.5
CVE-2026-20187
Cisco RoomOS Security Hardening Release - Exceptional Conditions Handling Vulnerabilities