Vulnerability Details : CVE-2022-20689
Multiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, adjacent attacker to cause Cisco Discovery Protocol memory corruption on an affected device.
These vulnerabilities are due to missing length validation checks when processing Cisco Discovery Protocol messages. An attacker could exploit these vulnerabilities by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause an out-of-bounds read of the valid Cisco Discovery Protocol packet data, which could allow the attacker to cause corruption in the internal Cisco Discovery Protocol database of the affected device.
Vulnerability category: Memory CorruptionInput validation
Products affected by CVE-2022-20689
- cpe:2.3:o:cisco:ata_190_firmware:-:*:*:*:on-premises:*:*:*
- cpe:2.3:o:cisco:ata_191_firmware:*:*:*:*:multiplatform:*:*:*
- cpe:2.3:o:cisco:ata_191_firmware:*:*:*:*:on-premises:*:*:*
- cpe:2.3:o:cisco:ata_191_firmware:12.0.1:sr1:*:*:on-premises:*:*:*
- cpe:2.3:o:cisco:ata_191_firmware:12.0.1:sr2:*:*:on-premises:*:*:*
- cpe:2.3:o:cisco:ata_191_firmware:12.0.1:sr4:*:*:on-premises:*:*:*
- cpe:2.3:o:cisco:ata_191_firmware:12.0.1:sr3:*:*:on-premises:*:*:*
- cpe:2.3:o:cisco:ata_191_firmware:12.0.1:-:*:*:on-premises:*:*:*
- cpe:2.3:o:cisco:ata_192_firmware:*:*:*:*:multiplatform:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-20689
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 27 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-20689
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
8.8
|
HIGH | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST | |
|
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
3.9
|
1.4
|
Cisco Systems, Inc. |
CWE ids for CVE-2022-20689
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
-
The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.Assigned by: ykramarz@cisco.com (Secondary)
-
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-20689
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multivuln-GEZYVvs
Cisco ATA 190 Series Analog Telephone Adapter Software VulnerabilitiesVendor Advisory
-
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multivuln-GEZYVvs
Cisco ATA 190 Series Analog Telephone Adapter Software Vulnerabilities
Jump to