{"api_version":"1","generated_at":"2026-09-11T03:19:41+00:00","cve":"CVE-2026-20302","urls":{"html":"https://cve.report/CVE-2026-20302","api":"https://cve.report/api/cve/CVE-2026-20302.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-20302","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-20302"},"summary":{"title":"Cisco RoomOS Stack Overflow Vulnerability","description":"A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with physical access to the USB port on an affected device to execute arbitrary code with root privileges.\r\n\r\nThis vulnerability is due to insufficient boundary checks for specific data that is provided through the USB driver. An attacker could exploit this vulnerability by connecting a malicious USB device to an affected device. A successful exploit could allow the attacker to cause a buffer overflow condition on the affected system and execute arbitrary code with root privileges.","state":"PUBLISHED","assigner":"cisco","published_at":"2026-08-19 17:18:39","updated_at":"2026-08-20 16:17:20"},"problem_types":["CWE-120","CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"],"metrics":[{"version":"3.1","source":"psirt@cisco.com","type":"Secondary","score":"6.1","severity":"MEDIUM","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSSV3_1","score":"6.1","severity":"MEDIUM","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","data":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-bof-vTMANZgu","name":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-bof-vTMANZgu","refsource":"psirt@cisco.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-20302","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20302","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 10.11.2.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 10.15.2.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.5.4.6","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.5.2.4","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 10.8.2.5","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 10.11.5.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 10.11.3.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 10.15.5.3","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 10.19.2.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.1.3.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 10.11.6.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 10.19.3.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 10.19.4.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 10.3.2.4","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 10.3.4.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 10.15.3.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.1.4.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.14.2.3","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.1.2.4","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 10.8.3.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.14.2.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 10.3.3.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 10.8.4.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 10.15.4.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 10.19.5.6","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 10.11.4.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.9.3.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.5.3.3","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 10.3.2.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.9.2.4","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.14.3.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.17.2.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.14.4.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 10.19 StepUpg","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.17.3.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.20.2.3","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.14.5.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.17.4.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.20.3.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.23.1.6","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.23.1.8","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.24.1.5","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.24.2.4","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.24.3.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.24.4.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.27.2.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.28.1.3","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.27.3.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.31.1.5","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.27.4.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.32.2.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.33.1.7","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 26.0.1.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.34.1.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.32.3.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.27.5.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.32.4.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 26.1.1.5","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.35.1.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 26.2.2.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.32.5.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 26.4.1.6","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 26.4.1.4","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 26.3.1.3","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.36.1.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.37.1.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 26.5.2.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 26.5.2.2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 26.6.1.4","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.38.1.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.32.6.0","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco RoomOS Software","version":"affected RoomOS 11.39.1.1","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[{"source":"CNA","title":"","value":"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.","time":"","lang":"en"}],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"20302","cve":"CVE-2026-20302","epss":"0.001840000","percentile":"0.082770000","score_date":"2026-08-23","updated_at":"2026-08-24 00:11:17"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-20302","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-08-20T15:40:09.736009Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-08-20T15:57:08.625Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unknown","product":"Cisco RoomOS Software","vendor":"Cisco","versions":[{"status":"affected","version":"RoomOS 10.11.2.2"},{"status":"affected","version":"RoomOS 10.15.2.2"},{"status":"affected","version":"RoomOS 11.5.4.6"},{"status":"affected","version":"RoomOS 11.5.2.4"},{"status":"affected","version":"RoomOS 10.8.2.5"},{"status":"affected","version":"RoomOS 10.11.5.2"},{"status":"affected","version":"RoomOS 10.11.3.0"},{"status":"affected","version":"RoomOS 10.15.5.3"},{"status":"affected","version":"RoomOS 10.19.2.2"},{"status":"affected","version":"RoomOS 11.1.3.1"},{"status":"affected","version":"RoomOS 10.11.6.0"},{"status":"affected","version":"RoomOS 10.19.3.0"},{"status":"affected","version":"RoomOS 10.19.4.2"},{"status":"affected","version":"RoomOS 10.3.2.4"},{"status":"affected","version":"RoomOS 10.3.4.0"},{"status":"affected","version":"RoomOS 10.15.3.0"},{"status":"affected","version":"RoomOS 11.1.4.1"},{"status":"affected","version":"RoomOS 11.14.2.3"},{"status":"affected","version":"RoomOS 11.1.2.4"},{"status":"affected","version":"RoomOS 10.8.3.1"},{"status":"affected","version":"RoomOS 11.14.2.1"},{"status":"affected","version":"RoomOS 10.3.3.0"},{"status":"affected","version":"RoomOS 10.8.4.0"},{"status":"affected","version":"RoomOS 10.15.4.1"},{"status":"affected","version":"RoomOS 10.19.5.6"},{"status":"affected","version":"RoomOS 10.11.4.1"},{"status":"affected","version":"RoomOS 11.9.3.1"},{"status":"affected","version":"RoomOS 11.5.3.3"},{"status":"affected","version":"RoomOS 10.3.2.0"},{"status":"affected","version":"RoomOS 11.9.2.4"},{"status":"affected","version":"RoomOS 11.14.3.0"},{"status":"affected","version":"RoomOS 11.17.2.2"},{"status":"affected","version":"RoomOS 11.14.4.0"},{"status":"affected","version":"RoomOS 10.19 StepUpg"},{"status":"affected","version":"RoomOS 11.17.3.0"},{"status":"affected","version":"RoomOS 11.20.2.3"},{"status":"affected","version":"RoomOS 11.14.5.0"},{"status":"affected","version":"RoomOS 11.17.4.0"},{"status":"affected","version":"RoomOS 11.20.3.0"},{"status":"affected","version":"RoomOS 11.23.1.6"},{"status":"affected","version":"RoomOS 11.23.1.8"},{"status":"affected","version":"RoomOS 11.24.1.5"},{"status":"affected","version":"RoomOS 11.24.2.4"},{"status":"affected","version":"RoomOS 11.24.3.0"},{"status":"affected","version":"RoomOS 11.24.4.1"},{"status":"affected","version":"RoomOS 11.27.2.0"},{"status":"affected","version":"RoomOS 11.28.1.3"},{"status":"affected","version":"RoomOS 11.27.3.0"},{"status":"affected","version":"RoomOS 11.31.1.5"},{"status":"affected","version":"RoomOS 11.27.4.0"},{"status":"affected","version":"RoomOS 11.32.2.1"},{"status":"affected","version":"RoomOS 11.33.1.7"},{"status":"affected","version":"RoomOS 26.0.1.2"},{"status":"affected","version":"RoomOS 11.34.1.2"},{"status":"affected","version":"RoomOS 11.32.3.0"},{"status":"affected","version":"RoomOS 11.27.5.0"},{"status":"affected","version":"RoomOS 11.32.4.0"},{"status":"affected","version":"RoomOS 26.1.1.5"},{"status":"affected","version":"RoomOS 11.35.1.2"},{"status":"affected","version":"RoomOS 26.2.2.2"},{"status":"affected","version":"RoomOS 11.32.5.1"},{"status":"affected","version":"RoomOS 26.4.1.6"},{"status":"affected","version":"RoomOS 26.4.1.4"},{"status":"affected","version":"RoomOS 26.3.1.3"},{"status":"affected","version":"RoomOS 11.36.1.1"},{"status":"affected","version":"RoomOS 11.37.1.0"},{"status":"affected","version":"RoomOS 26.5.2.0"},{"status":"affected","version":"RoomOS 26.5.2.2"},{"status":"affected","version":"RoomOS 26.6.1.4"},{"status":"affected","version":"RoomOS 11.38.1.1"},{"status":"affected","version":"RoomOS 11.32.6.0"},{"status":"affected","version":"RoomOS 11.39.1.1"}]}],"descriptions":[{"lang":"en","value":"A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with physical access to the USB port on an affected device to execute arbitrary code with root privileges.\r\n\r\nThis vulnerability is due to insufficient boundary checks for specific data that is provided through the USB driver. An attacker could exploit this vulnerability by connecting a malicious USB device to an affected device. A successful exploit could allow the attacker to cause a buffer overflow condition on the affected system and execute arbitrary code with root privileges."}],"exploits":[{"lang":"en","value":"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"format":"cvssV3_1"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-120","description":"Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","lang":"en","type":"cwe"}]}],"providerMetadata":{"dateUpdated":"2026-08-19T16:17:07.749Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","shortName":"cisco"},"references":[{"name":"cisco-sa-roomos-bof-vTMANZgu","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-bof-vTMANZgu"}],"source":{"advisory":"cisco-sa-roomos-bof-vTMANZgu","defects":["CSCwu31332"],"discovery":"EXTERNAL"},"title":"Cisco RoomOS Stack Overflow Vulnerability"}},"cveMetadata":{"assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","assignerShortName":"cisco","cveId":"CVE-2026-20302","datePublished":"2026-08-19T16:17:07.749Z","dateReserved":"2025-10-08T11:59:15.408Z","dateUpdated":"2026-08-20T15:57:08.625Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-19 17:18:39","lastModifiedDate":"2026-08-20 16:17:20","problem_types":["CWE-120","CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"],"metrics":{"cvssMetricV31":[{"source":"psirt@cisco.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":0.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-20T15:40:09.736009Z","id":"CVE-2026-20302","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"20302","Ordinal":"1","Title":"Cisco RoomOS Stack Overflow Vulnerability","CVE":"CVE-2026-20302","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"20302","Ordinal":"1","NoteData":"A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with physical access to the USB port on an affected device to execute arbitrary code with root privileges.\r\n\r\nThis vulnerability is due to insufficient boundary checks for specific data that is provided through the USB driver. An attacker could exploit this vulnerability by connecting a malicious USB device to an affected device. A successful exploit could allow the attacker to cause a buffer overflow condition on the affected system and execute arbitrary code with root privileges.","Type":"Description","Title":"Cisco RoomOS Stack Overflow Vulnerability"}]}}}