PT-2025-42378 · Cisco · Cisco Telepresence Collaboration Endpoint+1

Published 2025-10-15 · Updated 2025-12-01 · CVE-2025-20329

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Collaboration Endpoint and Cisco RoomOS Software (affected versions not specified)

Description A flaw exists in the logging component that may allow a remote attacker with administrative access to view sensitive information in clear text. The issue stems from unencrypted credentials being stored when SIP media component logging is enabled. An attacker could access audit logs on an affected system and obtain credentials, potentially gaining access to confidential information, including personally identifiable information (PII). The attacker must have valid administrative credentials to access the logs stored in the Webex Cloud or on the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2025-20329

Affected Products

Cisco Roomos

Cisco Telepresence Collaboration Endpoint

References · 10

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-inf-disc-qGgsbxAm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20329 · Security Note
• https://osv.dev/vulnerability/CVE-2025-20329 · Vendor Advisory
• https://twitter.com/0dayPublishing/status/1978513528454549975 · Twitter Post
• https://twitter.com/dailycve/status/1995606081188553080 · Twitter Post
• https://twitter.com/CVEnew/status/1978545038939554013 · Twitter Post
• https://twitter.com/SystemTek_UK/status/1979275536825237831 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1978694029379260890 · Twitter Post
• https://t.me/cveNotify/138833 · Telegram Post
• https://t.me/CVEtracker/35022 · Telegram Post