Remote Code Execution Vulnerability in Cisco ATA 190 Series by Cisco
CVE-2022-20688

5.3MEDIUM

Key Information:

Vendor

Cisco
Status
Cisco Analog Telephone Adaptor (ata) Software
Vendor
CVE Published:
12 December 2022

Badges

👾 Exploit Exists

What is CVE-2022-20688?

A flaw in the Cisco Discovery Protocol functionality of the Cisco ATA 190 Series Analog Telephone Adapter firmware allows unauthenticated remote attackers to send specially crafted packets that lack proper length validation. This can lead to arbitrary code execution on the affected device, causing unexpected service restarts and potential denial-of-service conditions. Successful exploitation may compromise the integrity and availability of the device, highlighting the importance of timely updates to mitigate this risk.

Affected Version(s)

Cisco Analog Telephone Adaptor (ATA) Software 1.2.1

Cisco Analog Telephone Adaptor (ATA) Software 1.2.2 SR1

Cisco Analog Telephone Adaptor (ATA) Software 1.2.2

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.