Cisco RoomOS Software Privilege Escalation Vulnerability
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A vulnerability in Cisco RoomOS Software could allow an authenticated, local attacker to write files to the underlying filesystem with root privileges. The vulnerability is due to insufficient permission restrictions on a specific process. An attacker could exploit this vulnerability by logging in to an affected device with remote support credentials and initiating the specific process on the device and sending crafted data to that process. A successful exploit could allow the attacker to write files to the underlying file system with root privileges.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco TelePresence CE Software | before ce-9.7.3 | ce-9.7.3 | Patch available | CNA |
- Cisco TelePresence CE Software VendorCisco Affected before ce-9.7.3 Fixed in ce-9.7.3 Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:cisco:telepresence_codec_c40_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Cisco |
| cpe:2.3:h:cisco:telepresence_codec_c40:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:telepresence_codec_c60_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Cisco |
| cpe:2.3:h:cisco:telepresence_codec_c60:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:telepresence_codec_c90_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Cisco |
| cpe:2.3:h:cisco:telepresence_codec_c90:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:roomos:*:*:*:*:*:*:*:* | up to 9.7.2; after 9.7.3, before 9.8.0 | Vulnerable | Cisco |
- cpe:2.3:o:cisco:telepresence_codec_c40_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
- cpe:2.3:h:cisco:telepresence_codec_c40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:telepresence_codec_c60_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
- cpe:2.3:h:cisco:telepresence_codec_c60:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:telepresence_codec_c90_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
- cpe:2.3:h:cisco:telepresence_codec_c90:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:roomos:*:*:*:*:*:*:*:* Versions up to 9.7.2; after 9.7.3, before 9.8.0 Vulnerable ·Cisco
Remediation
- Fix · CNA Cisco TelePresence CE Software (Cisco) Fixed in ce-9.7.3
Timeline
- 2026-10-02 Threatist record created from CVE-2019-12622
- 2026-10-03 Alias added: GHSA-cw6x-mqv8-rmmr
References
More Cisco Roomos vulnerabilities
- TI-2019-11399 Cisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Privilege Escalation Vulnerability CVSS 3.1HIGH 8.8
- TI-2026-16365 Cisco RoomOS Security Hardening Release - Buffer Management Vulnerabilities CVSS 3.1CRITICAL 9.8
- TI-2026-16366 Cisco RoomOS Security Hardening Release - Missing Encryption Vulnerabilities CVSS 3.1CRITICAL 9.8
- TI-2022-05342 Cisco TelePresence Collaboration Endpoint and RoomOS Software H.323 Denial of Service Vulnerability CVSS 3.1HIGH 7.5
- TI-2019-11400 Cisco TelePresence Collaboration Endpoint and RoomOS Software Denial of Service Vulnerabilities CVSS 3.1HIGH 7.5
- TI-2026-16359 Cisco RoomOS Security Hardening Release - Access Control Vulnerabilities CVSS 3.1HIGH 8.8
Sources
- CVE-2019-12622 · CVE Program
- CVE-2019-12622 · NVD
- FIRST EPSS
- GHSA-cw6x-mqv8-rmmr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences