Vulnerabilities
Cisco RoomOS USB Driver Flaw Lets Local Attacker Gain Root Privileges
A buffer‑overflow bug in Cisco’s RoomOS USB driver allows a physically‑present attacker to execute arbitrary code as root. The issue arises from missing boundary checks on USB data. Cisco has released patches; no workarounds are available.
A recent advisory reveals a critical flaw in Cisco RoomOS’s USB driver. The vulnerability stems from inadequate bounds checking on data received via the USB interface, which can be triggered by a malicious USB device. When exploited, the flaw causes a buffer overflow that grants an attacker full root privileges on the affected system.
Only an attacker with physical access to the device’s USB port can leverage this weakness. Cisco has issued software updates that address the issue, and there are currently no mitigations other than applying the patch.
Security teams should verify that all RoomOS deployments are updated to the latest firmware to eliminate the risk. The flaw is catalogued as CVE‑2026‑20302 with a medium severity rating.
Related vulnerabilities
Critical PAN-OS Buffer Overflow (CVE‑2026‑0300) Enables Root‑Level Code Execution
Palo Alto Networks has disclosed a 9.3‑scored buffer overflow in the User‑ID Authentication Portal of PAN‑OS that lets an unauthenticated attacker run arbitrary code with root privileges on PA‑Series and VM‑Series firewalls. Affected firmware spans versions before 12.1.4‑h5, 12.1.7, 11.2.4‑h17, and several earlier releases. No patch is live yet, but Palo Alto will ship one soon. Until then, limit or disable the captive portal. Immediate update is urged to shut the door on this critical flaw.
Read briefing
Wärtsilä FOS‑Onboard Faces Dual Hard‑Coded Key Vulnerabilities (CVE‑2026‑78225, CVE‑2026‑81855)
Two critical CVEs expose hard‑coded cryptographic keys in Wärtsilä FOS‑Onboard 5.07.0923.01, allowing attackers to push unauthorized updates, execute code or steal credentials. With a CVSS score of 9.1, the flaws threaten transportation‑system operators worldwide. Wärtsilä has released a patch; users must contact the vendor to apply it immediately.
Read briefing
Cisco ISE Web Interface Vulnerability Allows Remote XSS Attack (CVE‑2026‑20309)
A newly disclosed flaw in Cisco Identity Services Engine’s web‑based management console lets attackers inject malicious scripts into a victim’s browser. The vulnerability stems from inadequate input validation, enabling reflected XSS that can run arbitrary code or steal browser data. Cisco has released patches; no workarounds exist.
Read briefing
Cisco BroadWorks XML Parser Vulnerability (CVE‑2026‑20320) Enables Remote File Disclosure
A flaw in Cisco BroadWorks’ Open Client Interface XML parser lets unauthenticated attackers send crafted messages to the OCI‑P service and retrieve sensitive configuration files. The issue stems from default external entity resolution, enabling a blind XML External Entity (XXE) injection. Cisco has issued patches; no work‑arounds exist. Systems running BroadWorks should apply the update immediately.
Read briefing