Cisco RoomOS

CVE-2026-111497, Brotli decoder flaw in Siemens Desigo CC and Industrial Edge, Mitel MiVoice Business and OpenScape, with Cisco listing Duo Network Gateway and RoomOS in its combined advisory: Desigo CC takes the .NET updates, while Mitel updates and the Industrial Edge Common Configurator fix are still pending

The Brotli decoder flaw CVE-2026-111497 is an out-of-bounds write caused by improper handling of malformed compressed data (Mitel, 2026-10-28), and CISA lists it as exploited (CISA, 2026-10-27). Siemens' advisory SSA-045512, revised on 2026-11-06, lists Desigo CC V8 and V9, all versions, remedied by installing the latest .NET security updates via Windows Update, and scores the flaw CVSS 3.1 9.8 (Siemens ProductCERT, 2026-10-30). Its Industrial Edge advisory SSA-443410 says an Industrial Edge Management setup with no Management Applications installed needs no action because the affected functionality is not used or exposed, gives fixed versions for six configurator and monitoring applications, and for Common Configurator, which has no fix, says to uninstall all Management Applications and protect the instance with a firewall or WAF, or on a device to stop the application, until a fix is available (Siemens ProductCERT, 2026-10-30).

Mitel's MISA-2026-0010, revision 5.0 of 2026-11-04, rates the flaw high (CVSS 3.1 8.1) and lists MiVoice Business 10.6.0.7 and earlier, its Solution Virtual Instance up to the build in Mitel's table, OpenScape SBC V11R3.4.4 and earlier, OpenScape SESAP V2 R1.1.9 and earlier, OpenScape Contact Center V12R0 to V12R0FR7, OpenScape Xpert V9 R0.2.0 and earlier and OpenScape Endpoint Management V1 R2.5.1 and earlier as affected; for each an update is planned, not released, and workaround articles exist for OpenScape SBC, SESAP and Contact Center (Mitel, 2026-10-28). Mitel rates the risk low for MiVoice Business, Xpert and Endpoint Management when deployed according to its guidelines, and still lists several products as under investigation (Mitel, 2026-10-28).

Cisco's advisory, version 1.8 of 2026-11-06 and revised often, says its PSIRT is aware that proof-of-concept exploit code is available and is not aware of any malicious use against any Cisco product; it lists Catalyst SD-WAN, IOS XE, IOS XR and Secure Firewall ASA, FMC and FTD as not impacted and Identity Services Engine as under investigation (Cisco PSIRT, 2026-10-27). Its one fix table for the advisory's four CVEs, with no column for which CVE a fix addresses, lists Duo Network Gateway (3.4.2), Spaces (24.22.1), RoomOS on Board, Desk and Room Series devices (on-premises 11.41.2.3 and 26.7.4.3) and a longer list whose fixes are dated November 2026 to July 2027 (Cisco PSIRT, 2026-10-27).

Builds on: Node2Shell Brotli flaw is now on CISA KEV, with exploit traffic seen against Node.js 24.22.0… · Microsoft ships out-of-band .NET fixes: hosts updated on 13 October still carry the Windows…