CVE-2022-20793

Published: Nov 15, 2024Modified: Jun 17, 2026

6.8

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Exploitability: 1.6 / Impact: 5.2

Source: psirt@cisco.com (Secondary)

Description

A vulnerability in pairing process of Cisco TelePresence CE Software and RoomOS Software for Cisco Touch 10 Devices could allow an unauthenticated, remote attacker to impersonate a legitimate device and pair with an affected device. This vulnerability is due to insufficient identity verification. An attacker could exploit this vulnerability by impersonating a legitimate device and responding to the pairing broadcast from an affected device. A successful exploit could allow the attacker to access the affected device while impersonating a legitimate device.There are no workarounds that address this vulnerability.

Affected (42)

Products: Cisco: Telepresence Collaboration Endpoint, Roomos

Cisco

2 products

Telepresence Collaboration Endpoint

Roomos

Configuration A

41 vulnerable

Vulnerable Software	Affected Versions
Cisco Telepresence Collaboration Endpoint	Version 9.0.1
Cisco Telepresence Collaboration Endpoint	Version 9.1.1
Cisco Telepresence Collaboration Endpoint	Version 9.1.2
Cisco Telepresence Collaboration Endpoint	Version 9.1.3
Cisco Telepresence Collaboration Endpoint	Version 9.1.4
Cisco Telepresence Collaboration Endpoint	Version 9.1.5
Cisco Telepresence Collaboration Endpoint	Version 9.1.6
Cisco Telepresence Collaboration Endpoint	Version 9.10.1
Cisco Telepresence Collaboration Endpoint	Version 9.10.2
Cisco Telepresence Collaboration Endpoint	Version 9.10.3
Cisco Telepresence Collaboration Endpoint	Version 9.12.3
Cisco Telepresence Collaboration Endpoint	Version 9.12.4
Cisco Telepresence Collaboration Endpoint	Version 9.12.5
Cisco Telepresence Collaboration Endpoint	Version 9.13.0
Cisco Telepresence Collaboration Endpoint	Version 9.13.1
Cisco Telepresence Collaboration Endpoint	Version 9.13.2
Cisco Telepresence Collaboration Endpoint	Version 9.13.3
Cisco Telepresence Collaboration Endpoint	Version 9.14.3
Cisco Telepresence Collaboration Endpoint	Version 9.14.4
Cisco Telepresence Collaboration Endpoint	Version 9.14.5
Cisco Telepresence Collaboration Endpoint	Version 9.14.6
Cisco Telepresence Collaboration Endpoint	Version 9.14.7
Cisco Telepresence Collaboration Endpoint	Version 9.15.0.10
Cisco Telepresence Collaboration Endpoint	Version 9.15.0.11
Cisco Telepresence Collaboration Endpoint	Version 9.15.0.13
Cisco Telepresence Collaboration Endpoint	Version 9.15.0.19
Cisco Telepresence Collaboration Endpoint	Version 9.15.10.8
Cisco Telepresence Collaboration Endpoint	Version 9.15.13.0
Cisco Telepresence Collaboration Endpoint	Version 9.15.3.17
Cisco Telepresence Collaboration Endpoint	Version 9.15.3.18
Cisco Telepresence Collaboration Endpoint	Version 9.15.3.19
Cisco Telepresence Collaboration Endpoint	Version 9.15.3.22
Cisco Telepresence Collaboration Endpoint	Version 9.15.3.25
Cisco Telepresence Collaboration Endpoint	Version 9.15.3.26
Cisco Telepresence Collaboration Endpoint	Version 9.15.8.12
Cisco Telepresence Collaboration Endpoint	Version 9.2.1
Cisco Telepresence Collaboration Endpoint	Version 9.2.2
Cisco Telepresence Collaboration Endpoint	Version 9.2.3
Cisco Telepresence Collaboration Endpoint	Version 9.2.4
Cisco Telepresence Collaboration Endpoint	Version 9.9.3
Cisco Telepresence Collaboration Endpoint	Version 9.9.4

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Cisco Roomos	All versions

Related CWEs

CWE-325

Missing Cryptographic Step

The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.

References (1)

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CTT-IVV-4A66Dsfj

Source: psirt@cisco.com

Vendor Advisory

Timeline

No history available yet.