CVE-2025-20329: Cisco Telepresence Information Disclosure

CVE-2025-20329 Overview

Cisco disclosed an information disclosure vulnerability affecting Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software. The flaw resides in the logging component and allows an authenticated remote attacker with administrative credentials to view sensitive information in clear text. The issue is tracked under CWE-532: Insertion of Sensitive Information into Log File.

When Session Initiation Protocol (SIP) media component logging is enabled, the affected software writes unencrypted credentials into audit logs. An attacker with valid administrative access to the device or to Webex Cloud–stored logs can harvest those credentials and reuse them to reach confidential data, including personally identifiable information (PII).

Critical Impact

Authenticated administrators can extract clear-text credentials from SIP media logs and pivot to systems containing PII and other confidential data.

Affected Products

• Cisco TelePresence Collaboration Endpoint (CE) Software
• Cisco RoomOS Software
• Devices with SIP media component logging enabled

Discovery Timeline

• 2025-10-15 - CVE-2025-20329 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-20329

Vulnerability Analysis

The vulnerability is an information disclosure issue rooted in improper handling of sensitive data during logging operations. When SIP media component logging is active, the logging subsystem records credential material without applying encryption, redaction, or masking. Any principal that can read the audit logs can therefore read authentication secrets in plaintext.

Exploitation requires valid administrative credentials to reach either the on-device audit logs or the copies stored in the Webex Cloud. This constraint limits the attacker population to insiders, compromised administrator accounts, or attackers who have already achieved a foothold at the management tier. The impact is confidentiality-only, with no integrity or availability effect on the collaboration endpoint itself.

The practical risk is credential expansion. Recovered credentials may unlock other back-end systems reachable from the collaboration environment, including systems that hold PII. This turns a single administrator compromise into broader lateral movement across trust boundaries.

Root Cause

The root cause is a CWE-532 defect: the SIP media logging path serializes credential fields into audit records without applying redaction or cryptographic protection. Log records intended for troubleshooting therefore double as a credential store.

Attack Vector

The attack vector is network-based but gated by administrative authentication. A workflow looks like this:

1. Attacker obtains valid administrator credentials for the TelePresence CE or RoomOS device, or for the associated Webex Cloud tenant.
2. Attacker confirms that SIP media component logging is enabled on the target endpoint.
3. Attacker retrieves audit logs from the device or from Webex Cloud storage.
4. Attacker parses the log records for clear-text credentials and reuses them against downstream systems.

No verified public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities Catalog.

The vulnerability is described in prose only; Cisco has not published exploitation code, and no realCodeExamples were verified for this advisory. Refer to the Cisco Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2025-20329

Indicators of Compromise

• Audit log entries generated by the SIP media component containing credential-like fields (for example, password=, secret=, or base64-encoded authentication tokens) in clear text.
• Administrative log-download or log-export actions from accounts that do not normally perform troubleshooting.
• Access to Webex Cloud log archives from unexpected source IP addresses or geographies.

Detection Strategies

• Inventory all TelePresence CE and RoomOS endpoints and identify which have SIP media component logging enabled.
• Search stored audit logs for credential patterns to determine whether secrets are already exposed and require rotation.
• Correlate administrator authentication events with subsequent log-retrieval activity to spot log-scraping behavior.

Monitoring Recommendations

• Alert on any change to the SIP media logging configuration on RoomOS or TelePresence CE devices.
• Monitor Webex Cloud administrative APIs for bulk log downloads and unusual export volumes.
• Track reuse of service or shared credentials that appear in device logs against authentication events in downstream systems.

How to Mitigate CVE-2025-20329

Immediate Actions Required

• Apply the fixed RoomOS and TelePresence CE software releases identified in the Cisco Security Advisory.
• Disable SIP media component logging on production endpoints unless it is actively required for troubleshooting.
• Rotate any credentials that may have been recorded in audit logs on affected devices or in Webex Cloud storage.
• Review and reduce the number of accounts holding administrative privileges on collaboration endpoints.

Patch Information

Cisco has released fixed software for both Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS. Consult the Cisco Security Advisory cisco-sa-roomos-inf-disc-qGgsbxAm for the fixed release matrix and upgrade guidance specific to your deployment.

Workarounds

• Turn off SIP media component logging until affected endpoints are upgraded to a fixed release.
• Restrict access to audit logs and Webex Cloud log archives to a minimal set of named administrators.
• Purge historical log data that contains clear-text credentials after credential rotation is complete.
• Enforce multi-factor authentication (MFA) for all administrative access to collaboration endpoints and the Webex Cloud tenant.