CVE-2026-20289
Received Received - Intake

Information Disclosure in Cisco RoomOS

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Cisco Systems, Inc.

Description
A vulnerability in the logging subsystem of Cisco RoomOS could allow an authenticated, local attacker with low privileges to access sensitive information. This vulnerability is due to the logging of sensitive information. An attacker could exploit this vulnerability by enabling a specific logging level and then collecting the system logs. A successful exploit could allow the attacker to view sensitive information like user login credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-20289
EUVD
EUVD-2026-53474

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cisco roomos *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a medium-severity information disclosure vulnerability in Cisco RoomOS's logging subsystem. An authenticated local attacker with low privileges can enable a specific logging level and access system logs to view sensitive information like user login credentials. The issue only occurs when extended logging is enabled, which is not the default setting.

Detection Guidance

Check if extended logging is enabled in Cisco RoomOS. Review system logs for sensitive information like credentials. Cisco recommends upgrading to fixed software versions as there are no workarounds.

Impact Analysis

An attacker could exploit this to access sensitive data such as user login credentials stored in system logs. This could lead to unauthorized access to systems or accounts if the credentials are reused.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive information such as user login credentials, which may violate compliance requirements under GDPR and HIPAA if such data is exposed. Unauthorized disclosure of personal or health-related data could result in regulatory penalties or legal consequences for organizations.

Mitigation Strategies

Upgrade Cisco RoomOS to the fixed software versions provided by Cisco. Ensure extended logging is disabled if enabled. Monitor logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-20289. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart