CVE-2020-26086 Cisco TelePresence Collaboration Endpoint Software Information Disclosure Vulnerability

What is CVE-2020-26086?

CVE-2020-26086 is a medium-severity vulnerability in Cisco TelePresence Endpoint Software (TC/CE), published on 6 Nov 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in the video endpoint API (xAPI) of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, remote attacker to gain access to sensitive information on an affected device. The vulnerability is due to improper storage of sensitive information on an affected device. An attacker could exploit this vulnerability by accessing information that should not be accessible to users with low privileges. A successful exploit could allow the attacker to gain access to sensitive information.

Weakness: CWE-668

Which versions are affected by CVE-2020-26086?

It affects 1 product.

Products include Cisco Telepresence Collaboration Endpoint.

How do I fix CVE-2020-26086?

No fix has been published for CVE-2020-26086 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-26086 being exploited?

There is no known exploitation of CVE-2020-26086 in the wild and no public exploit code.

Other vulnerabilities in Cisco TelePresence Endpoint Software (TC/CE)

• CVE-2019-15275 Cisco TelePresence Collaboration Endpoint Software Privilege Escalation Vulnerability Medium 6.7
• CVE-2022-20931 Cisco Touch 10 Device Downgrade Attack Vulnerability Medium 6.5
• CVE-2019-15274 Cisco TelePresence Collaboration Endpoint Software Command Injection Vulnerability Medium 6.4
• CVE-2019-15277 Cisco TelePresence Collaboration Endpoint Software Privilege Escalation Vulnerability Medium 6.4
• CVE-2019-15273 Cisco TelePresence Collaboration Endpoint Software Arbitrary File Overwrite Vulnerabilities Medium 6.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cjpj-xr8x-3rg7.