PT-2022-5299 · Cisco · Cisco Ata 190 Series Adaptive Telephone Adapter

Qian Chen · Published 2022-10-05 · Updated 2024-01-25 · CVE-2022-20691

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco ATA 190 Series Adaptive Telephone Adapter (affected versions not specified)

Description The issue exists due to insufficient input validation in the Cisco Discovery Protocol implementation of the Cisco Analog Telephone Adapter (ATA) series 190 firmware. This could allow a remote attacker to cause a denial of service. The vulnerability is caused by missing length validation of certain Cisco Discovery Protocol packet header fields. An attacker could exploit this by sending crafted Cisco Discovery Protocol packets to an affected device, potentially causing the device to exhaust available memory and restart the service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-1284

CWE-20

Related Identifiers

BDU:2022-06584

CVE-2022-20691

Affected Products

Cisco Ata 190 Series Adaptive Telephone Adapter

References · 7

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multivuln-GEZYVvs · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20691 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06584 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-20691 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multivuln-GEZYVvs · Note
• https://t.me/cvenotify/39621 · Telegram Post
• https://t.me/cvenotify/39854 · Telegram Post