Cisco ATA 190 Series Analog Telephone Adapter Vulnerable to Reflected Cross-Site Scripting Attacks

CVE-2024-20460

Summary

A vulnerability exists within the web-based management interface of the Cisco ATA 190 Series Analog Telephone Adapter firmware, enabling unauthenticated, remote attackers to carry out reflected cross-site scripting (XSS) attacks. The root cause stems from insufficient validation of user input, which can be exploited if the attacker convinces a victim to click a specially crafted link. When successful, the exploit may allow arbitrary script code execution within the affected interface's context or lead to exposure of sensitive browser-based information on the compromised device. This vulnerability highlights the importance of securing management interfaces and sanitizing user inputs to prevent malicious exploits.

References