Home / Items
Vendor advisorySeverity 7.5 high
Cisco TelePresence Collaboration Endpoint Software and RoomOS Software Denial of Service Vulnerability
cisco-sa-tce-roomos-dos-9V9jrC2q · Cisco · February 4, 2026
Summary
A vulnerability in the text rendering subsystem of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to insufficient validation of input received by an affected device. An attacker could exploit this vulnerability by getting the affected device to render crafted text, for example, a crafted meeting invitation. As indicated in the CVSS score, no user interaction is required, such as accepting the meeting invitation. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
From Cisco (vendor's own words, quoted), quoted as published. Check the source before acting.
What to do
Cisco has released software updates that address this vulnerability.
Vendor fix or mitigation, quoted from the advisory.
Each CVE in this advisory
| CVE | Severity | Known exploited | Exploit likelihood |
|---|---|---|---|
| CVE-2026-20119 | 7.5 high | No | 0.4% |
Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).
Affected products
| Vendor | Product |
|---|---|
| Cisco | Cisco RoomOS Software |
| Cisco | Cisco TelePresence Endpoint Software (TC/CE) |
| Cisco | Cisco Room Series |
| Cisco | Cisco Board Series |
| Cisco | Cisco Desk Series |
| Cisco | Cisco TelePresence MX Series |
| Cisco | Cisco TelePresence SX Series |
| Cisco | Cisco Webex DX Series |
Why it's on these mode pages
- Maritime: Vendor table: Cisco (network and remote-access gear used in every mode, all modes) (matched by rule)
- Pipeline: Vendor table: Cisco (network and remote-access gear used in every mode, all modes) (matched by rule)
- Freight rail: Vendor table: Cisco (network and remote-access gear used in every mode, all modes) (matched by rule)
- Passenger rail and transit: Vendor table: Cisco (network and remote-access gear used in every mode, all modes) (matched by rule)
- Highway and motor carrier: Vendor table: Cisco (network and remote-access gear used in every mode, all modes) (matched by rule)
- Postal and parcel: Vendor table: Cisco (network and remote-access gear used in every mode, all modes) (matched by rule)
Change history
- February 4, 2026: Initial public release.
- February 10, 2026: Removed extraneous text from Fixed Releases.
- February 12, 2026: Updated fixed releases.
- November 9, 2026: First collected by Watch
Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com