Cisco RoomOS Stack Overflow Vulnerability
Cisco fixed a stack overflow in the RoomOS USB driver allowing physical-access attackers to execute code with root privileges.
Insufficient boundary checks in the USB driver of Cisco RoomOS allow a buffer overflow when specific data is supplied through the USB port. An unauthenticated local attacker with physical access can connect a malicious USB device and execute arbitrary code with root privileges. Cisco has released software updates and no workarounds address the issue.
- Stack overflow exists in the USB driver of Cisco RoomOS
- Exploitation requires physical access to the USB port
- Successful attacks yield arbitrary code execution with root privileges
- Software updates released; no workarounds available
- Vendors
- Cisco
- Products
- Cisco RoomOS
- Organizations
- Cisco
From the original article
A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with physical access to the USB port on an affected device to execute arbitrary code with root privileges. This vulnerability is due to insufficient boundary checks for specific data that is provided through the USB driver.
sec.cloudapps.cisco.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.