PT-2022-6066 · Cisco · Cisco Ata 190 Series Analog Telephone Adapter

Qian Chen · Published 2022-10-05 · Updated 2024-01-25 · CVE-2022-20688

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Cisco ATA 190 Series Analog Telephone Adapter (affected versions not specified)

Description A vulnerability in the Cisco Discovery Protocol functionality could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device and cause the Cisco Discovery Protocol service to restart. This issue is due to missing length validation of certain Cisco Discovery Protocol packet header fields. An attacker could exploit this by sending a malicious Cisco Discovery Protocol packet to an affected device, potentially allowing the attacker to execute code and cause the service to restart unexpectedly, resulting in a denial of service condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Improper Resource Release

Weakness Enumeration

CWE-125

CWE-404

CWE-1284

Related Identifiers

BDU:2022-07531

CVE-2022-20688

Affected Products

Cisco Ata 190 Series Analog Telephone Adapter

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-20688 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multivuln-GEZYVvs · Vendor Advisory
• https://cisco.com/c/en/us/support/docs/csa/cisco-sa-ata19x-multivuln-GEZYVvs.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-07531 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20688 · Vendor Advisory
• https://vuldb.com/?id.210198 · Note
• https://t.me/cvenotify/39855 · Telegram Post
• https://t.me/cvenotify/39624 · Telegram Post