CVE-2020-3336 Cisco TelePresence Collaboration Endpoint and RoomOS Software Command Injection Vulnerability
Authenticated attackers can inject commands via the upgrade process to gain root access or cause denial of service on Cisco TelePresence devices.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-3336?
CVE-2020-3336 is a high-severity command injection vulnerability in Cisco TelePresence CE Software, published on 18 Jun 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability in the software upgrade process of Cisco TelePresence Collaboration Endpoint Software and Cisco RoomOS Software could allow an authenticated, remote attacker to modify the filesystem to cause a denial of service (DoS) or gain privileged access to the root filesystem. The vulnerability is due to insufficient input validation. An attacker with administrative privileges could exploit this vulnerability by sending requests with malformed parameters to the system using the console, Secure Shell (SSH), or web API. A successful exploit could allow the attacker to modify the device configuration or cause a DoS.
Weakness: CWE-78
Which versions are affected by CVE-2020-3336?
It affects 2 products.
Products include Cisco Roomos, Cisco Telepresence Collaboration Endpoint.
How do I fix CVE-2020-3336?
No fix has been published for CVE-2020-3336 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-3336 being exploited?
There is no known exploitation of CVE-2020-3336 in the wild and no public exploit code.
Other vulnerabilities in Cisco TelePresence CE Software
- CVE-2026-20150 Cisco RoomOS Security Hardening Release - Access Control Vulnerabilities
- CVE-2019-15288 Cisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Privilege Escalation Vulnerability
- CVE-2026-20156 Cisco RoomOS Security Hardening Release - Buffer Management Vulnerabilities
- CVE-2026-20153 Cisco RoomOS Security Hardening Release - Input Validation Vulnerabilities
- CVE-2026-20157 Cisco RoomOS Security Hardening Release - Missing Encryption Vulnerabilities
Sources
Also known as GHSA-xm4r-pr55-hfw3.