Multiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, adjacent attacker to cause Cisco Discovery Protocol memory corruption on an affected device. These vulnerabilities are due to missing length validation checks when processing Cisco Discovery Protocol messages. An attacker could exploit these vulnerabilities by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause an out-of-bounds read of the valid Cisco Discovery Protocol packet data, which could allow the attacker to cause corruption in the internal Cisco Discovery Protocol database of the affected device.
Published 2022-12-12 09:15:12
Updated 2024-01-25 17:15:15
View at NVD,   CVE.org
Vulnerability category: Memory CorruptionInput validation

Exploit prediction scoring system (EPSS) score for CVE-2022-20690

0.06%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 25 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-20690

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
8.8
HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2.8
5.9
NIST
5.3
MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
3.9
1.4
Cisco Systems, Inc.

CWE ids for CVE-2022-20690

  • The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
    Assigned by: nvd@nist.gov (Primary)
  • The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
    Assigned by: ykramarz@cisco.com (Secondary)
  • The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
    Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-20690

Products affected by CVE-2022-20690

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!