CVE-2025-20329: Cisco RoomOS Software · Sensitive Data in Logs
Affects Cisco RoomOS SoftwareSource CVE Database V5
Not known to be exploited · CVSS 4.9 Medium.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 29% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 15 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
- Immediately audit and restrict administrative access to Cisco RoomOS devices and Webex Cloud logs to trusted personnel only, employing the principle of least privilege.
- Disable SIP media component logging if not essential, to prevent sensitive credentials from being logged in clear text.
- Apply any available patches or updates from Cisco addressing this vulnerability as soon as they are released.
- Implement strong multi-factor authentication (MFA) for all administrative accounts to reduce the risk of credential compromise.
- Regularly review and securely manage audit logs, ensuring sensitive information is redacted or encrypted where possible.
- Monitor logs and network activity for unusual access patterns to collaboration endpoints or log repositories.
- Educate administrators on the risks of credential exposure through logging and enforce secure logging configurations.
- Consider network segmentation to isolate collaboration devices from critical systems to limit lateral movement if credentials are compromised.
- Conduct periodic security assessments and penetration tests focusing on collaboration infrastructure to detect potential exploitation attempts.
Description
A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability exists because certain unencrypted credentials are stored when SIP media component logging is enabled. An attacker could exploit this vulnerability by accessing the audit logs on an affected system and obtaining credentials to which they may not normally have access. A successful exploit could allow the attacker to use those credentials to access confidential information, some of which may contain personally identifiable information (PII). Note: To access the logs that are stored in the Webex Cloud or stored on the device itself, an attacker must have valid administrative credentials.