CVE-2022-20768: cisco cisco roomos software

Vulnerability summary

CVE-2022-20768 is a medium (CVSS 4.9) vulnerability in cisco cisco roomos software. EPSS estimates a 0.97% chance of exploitation in the next 30 days, higher than 61.2% of scored vulnerabilities.

Timeline

1. 06-07-2022
   PublishedVulnerability first disclosed.
2. 01-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and RoomOS Software could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability is due to the storage of certain unencrypted credentials. An attacker could exploit this vulnerability by accessing the audit logs on an affected system and obtaining credentials that they may not normally have access to. A successful exploit could allow the attacker to use those credentials to access confidential information, some of which may contain personally identifiable information (PII). Note: To access the logs that are stored in the RoomOS Cloud, an attacker would need valid Administrator-level credentials.

• CWE-532Insertion of Sensitive Information into Log FileThe product writes sensitive information to a log file.