A vulnerability exists in the text rendering subsystem of Cisco TelePresence Collaboration Endpoint Software and Cisco RoomOS Software that allows a remote, unauthenticated attacker to engineer a denial of service by causing the device to reload. The flaw stems from insufficient validation of input, such that crafted text—such as a malicious meeting invitation—triggers the vulnerable rendering process. The weakness is a form of improper input validation (CWE‑1287), meaning the attacker does not need any privileges or user interaction to execute the exploit, and the impact is a loss of availability for the affected device.

The affected products are Cisco RoomOS Software and Cisco TelePresence Endpoint Software (TC/CE). No specific version numbers are listed in the advisory, so all devices running these products are considered vulnerable until a patch is applied.

With a CVSS score of 7.5 the vulnerability is considered high severity, but the EPSS score of less than 1 % indicates a low current probability of exploitation. The flaw is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been observed. An attacker can remotely send crafted text to a device—such as a malicious meeting invitation—without any authentication or user action, resulting in a device reload and a denial of service. Based on the description, it is inferred that the attack vector is remote via network access; exposed network connectivity to the devices is the primary risk factor.