CVE-2022-20793 Cisco Touch 10 Device Insufficient Identity Verification Vulnerability
An unauthenticated remote attacker can impersonate a legitimate device to pair with Cisco Touch 10 devices, gaining unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-20793?
CVE-2022-20793 is a medium-severity authentication bypass vulnerability in Cisco RoomOS Software, published on 15 Nov 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in pairing process of Cisco TelePresence CE Software and RoomOS Software for Cisco Touch 10 Devices could allow an unauthenticated, remote attacker to impersonate a legitimate device and pair with an affected device. This vulnerability is due to insufficient identity verification. An attacker could exploit this vulnerability by impersonating a legitimate device and responding to the pairing broadcast from an affected device. A successful exploit could allow the attacker to access the affected device while impersonating a legitimate device.There are no workarounds that address this vulnerability.
Weakness: CWE-325
Which versions are affected by CVE-2022-20793?
It affects 2 products.
Products include Cisco Roomos, Cisco Telepresence Collaboration Endpoint.
How do I fix CVE-2022-20793?
No fix has been published for CVE-2022-20793 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-20793 being exploited?
There is no known exploitation of CVE-2022-20793 in the wild and no public exploit code.
Other vulnerabilities in Cisco RoomOS Software
- CVE-2026-20150 Cisco RoomOS Security Hardening Release - Access Control Vulnerabilities
- CVE-2019-15288 Cisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Privilege Escalation Vulnerability
- CVE-2026-20156 Cisco RoomOS Security Hardening Release - Buffer Management Vulnerabilities
- CVE-2026-20153 Cisco RoomOS Security Hardening Release - Input Validation Vulnerabilities
- CVE-2026-20157 Cisco RoomOS Security Hardening Release - Missing Encryption Vulnerabilities
Sources
Also known as GHSA-w4wv-5x8m-w2cf.