PT-2024-7340 · Cisco · Cisco Ata 190 Series Analog Telephone Adapter

Published 2024-10-16 · Updated 2024-10-22 · CVE-2024-20461

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Cisco ATA 190 Series Analog Telephone Adapter firmware (affected versions not specified)

Description: The issue exists due to the lack of proper sanitization of CLI input, allowing an attacker to execute arbitrary commands as the root user by sending malicious characters to the CLI. This could enable the attacker to read and write to the underlying operating system as the root user.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-08696

CVE-2024-20461

Affected Products

Cisco Ata 190 Series Analog Telephone Adapter

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-20461 · Security Note
• https://bdu.fstec.ru/vul/2024-08696 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-20461 · Vendor Advisory
• https://t.me/cvedetector/8107 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1846749604382957892 · Twitter Post
• https://t.me/cvenotify/99128 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2024101746 · Note
• https://twitter.com/CVEnew/status/1846609973327155487 · Twitter Post