CVE-2022-20689

CWE-130CWE-1284CWE-120 — Classic Buffer OverflowCWE-125 — Out-of-bounds ReadCWE-400 — Uncontrolled Resource ConsumptionCWE-20 — Improper Input Validation4 documents4 sources
Severity
8.8HIGH
EPSS
0.6%
top 30.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Cisco ATA 191 FirmwareCisco ATA 192 FirmwareCisco Cisco Analog Telephone Adaptor (ata) Software
Timeline
PublishedDec 12

Description

Multiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, adjacent attacker to cause Cisco Discovery Protocol memory corruption on an affected device. These vulnerabilities are due to missing length validation checks when processing Cisco Discovery Protocol messages. An attacker could exploit these vulnerabilities by sending a malicious Cisco Discovery Protocol packet to an affected device. A s…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶NVDcisco/ata_191_firmware< 11.2.2+2

🔴Vulnerability Details

2
GHSA
GHSA-8pwq-5wx2-r2fc: Multiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauth↗2022-12-12
▶
CVEList
CVE-2022-20689: Multiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauth↗2022-12-07
▶

📋Vendor Advisories

1
Cisco
Cisco ATA 190 Series Analog Telephone Adapter Software Vulnerabilities↗2022-10-05
▶
CVE-2022-20689 (HIGH CVSS 8.8) | Multiple vulnerabilities in the Cis | cvebase.io