CVE-2022-20793

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

A vulnerability in pairing process of Cisco TelePresence CE Software and RoomOS Software for Cisco Touch 10 Devices could allow an unauthenticated, remote attacker to impersonate a legitimate device and pair with an affected device. This vulnerability is due to insufficient identity verification. An attacker could exploit this vulnerability by impersonating a legitimate device and responding to the pairing broadcast from an affected device. A successful exploit could allow the attacker to access the affected device while impersonating a legitimate device.There are no workarounds that address this vulnerability.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-325

Affected software

Vendor	Product	Versions
Cisco	Cisco RoomOS Software	N/A
Cisco	Cisco TelePresence Endpoint Software (TC/CE)	CE9.10.2; CE9.1.4; CE9.10.3; CE9.1.5; CE9.10.1; CE9.13.0; CE9.1.1; CE9.9.4; CE9.2.1; CE9.1.3; CE9.1.6; CE9.12.3; CE9.13.1; CE9.12.4; CE9.14.3; CE9.14.4; CE9.13.2; CE9.12.5; CE9.14.5; CE9.15.0.10
cisco	roomos	< *
cisco	telepresence_tc_software	< *
cisco	telepresence_ce_software	< *

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CTT-IVV-4A66DsfjVendor Advisory

Timeline

Published: Nov 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-207944.7Multiple vulnerabilities in the web engine of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow CVE-2022-207957.5A vulnerability in the implementation of the Datagram TLS (DTLS) protocol in Cisco Adaptive Security Appliance (ASA) Software and Cisco Fire CVE-2022-207965.5On May 4, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclose CVE-2022-207979.1A vulnerability in the web-based management interface of Cisco Secure Network Analytics, formerly Cisco Stealthwatch Enterprise, could allow CVE-2022-207989.8A vulnerability in the external authentication functionality of Cisco Secure Email and Web Manager, formerly known as Cisco Security Managem CVE-2022-207997.2Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated,CVE-2022-20804.3The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original send CVE-2022-208006.1A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Man CVE-2022-208017.2Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated,CVE-2022-208025.4A vulnerability in the web interface of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cro CVE-2022-208037.5A vulnerability in the OLE2 file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 could allow an unauthenticated, remote a CVE-2022-208046.5A vulnerability in the Cisco Discovery Protocol of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manage