PT-2022-6175 · Cisco · Cisco Ata 190 Series Analog Telephone Adapter

Qian Chen · Published 2022-10-05 · Updated 2024-01-25 · CVE-2022-20689

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco ATA 190 Series Analog Telephone Adapter (affected versions not specified)

Description The issue is related to the implementation of the Cisco Discovery Protocol in the firmware of Cisco Analog Telephone Adapter (ATA) series 190 devices. It is caused by a lack of input data validation, which could allow a remote attacker to impact the integrity of protected information. The vulnerability is due to missing length validation checks when processing Cisco Discovery Protocol messages. An attacker could exploit this by sending a malicious Cisco Discovery Protocol packet to an affected device, potentially causing an out-of-bounds read of valid packet data and leading to corruption in the internal Cisco Discovery Protocol database.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-130

CWE-1284

CWE-77

Related Identifiers

BDU:2023-00305

CVE-2022-20689

Affected Products

Cisco Ata 190 Series Analog Telephone Adapter

References · 8

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multivuln-GEZYVvs · Vendor Advisory
• https://cisco.com/c/en/us/support/docs/csa/cisco-sa-ata19x-multivuln-GEZYVvs.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20689 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00305 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-20689 · Security Note
• https://vuldb.com/zh/?id.210199 · Note
• https://t.me/cvenotify/39623 · Telegram Post
• https://t.me/cvenotify/39857 · Telegram Post