CVE-2020-26068 Cisco Telepresence CE Software and RoomOS Software Unauthorized Token Generation Vulnerability
An authenticated attacker can generate unauthorized tokens to enable restricted experimental features on Cisco Telepresence devices.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-26068?
CVE-2020-26068 is a medium-severity missing authorization vulnerability in Cisco TelePresence Endpoint Software (TC/CE), published on 18 Nov 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability in the xAPI service of Cisco Telepresence CE Software and Cisco RoomOS Software could allow an authenticated, remote attacker to generate an access token for an affected device. The vulnerability is due to insufficient access authorization. An attacker could exploit this vulnerability by using the xAPI service to generate a specific token. A successful exploit could allow the attacker to use the generated token to enable experimental features on the device that should not be available to users.
Weakness: CWE-639
Which versions are affected by CVE-2020-26068?
It affects 2 products.
Products include Cisco Roomos, Cisco Telepresence Collaboration Endpoint.
How do I fix CVE-2020-26068?
No fix has been published for CVE-2020-26068 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-26068 being exploited?
There is no known exploitation of CVE-2020-26068 in the wild and no public exploit code.
Other vulnerabilities in Cisco TelePresence Endpoint Software (TC/CE)
- CVE-2026-20150 Cisco RoomOS Security Hardening Release - Access Control Vulnerabilities
- CVE-2019-15288 Cisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Privilege Escalation Vulnerability
- CVE-2026-20156 Cisco RoomOS Security Hardening Release - Buffer Management Vulnerabilities
- CVE-2026-20153 Cisco RoomOS Security Hardening Release - Input Validation Vulnerabilities
- CVE-2026-20157 Cisco RoomOS Security Hardening Release - Missing Encryption Vulnerabilities
Sources
Also known as GHSA-m8hx-3q8c-m23r.