PT-2022-6064 · Cisco · Cisco Ata 190 Series Analog Telephone Adapter

Qian Chen · Published 2022-10-05 · Updated 2024-01-25 · CVE-2022-20686

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Cisco ATA 190 Series Analog Telephone Adapter (affected versions not specified)

Description The issue is related to the implementation of the Link Layer Discovery Protocol (LLDP) functionality in the firmware of Cisco Analog Telephone Adapter (ATA) series 190 devices. It is caused by missing length validation of certain LLDP packet header fields. An attacker could exploit this by sending a malicious LLDP packet to an affected device, potentially allowing them to execute arbitrary code on the device and cause the LLDP service to restart, resulting in a denial of service (DoS) condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-130

CWE-1284

CWE-120

Related Identifiers

BDU:2022-07529

CVE-2022-20686

Affected Products

Cisco Ata 190 Series Analog Telephone Adapter

References · 6

• https://bdu.fstec.ru/vul/2022-07529 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-20686 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20686 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multivuln-GEZYVvs · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multivuln-GEZYVvs · Note
• https://t.me/cvenotify/39626 · Telegram Post