CVSS: 6.5EPSS: 0%CPEs: 13EXPL: 0CVE-2022-20691
https://notcve.org/view.php?id=CVE-2022-20691
A vulnerability in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Adaptive Telephone Adapter firmware could allow an unauthenticated, adjacent attacker to cause a DoS condition of an affected device. This vulnerability is due to missing length validation of certain Cisco Discovery Protocol packet header fields. An attacker could exploit this vulnerability by sending crafted Cisco Discovery Protocol packets to an affected device. A successful exploit could allow the attacker to cause the device to exhaust available memory and cause the service to restart. Cisco has released firmware updates that address this vulnerability. Una vulnerabilidad en la funcionalidad Cisco Discovery Protocol del firmware del adaptador telefónico adaptable Cisco ATA serie 190 podría permitir que un atacante adyacente no autenticado cause una condición DoS en un dispositivo afectado. Esta vulnerabilidad se debe a la falta de validación de longitud de ciertos campos de encabezado de paquetes de Cisco Discovery Protocol. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multivuln-GEZYVvs • CWE-400: Uncontrolled Resource Consumption CWE-1284: Improper Validation of Specified Quantity in Input •
CVSS: 8.8EPSS: 0%CPEs: 13EXPL: 0CVE-2022-20690
https://notcve.org/view.php?id=CVE-2022-20690
Multiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, adjacent attacker to cause Cisco Discovery Protocol memory corruption on an affected device. These vulnerabilities are due to missing length validation checks when processing Cisco Discovery Protocol messages. An attacker could exploit these vulnerabilities by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause an out-of-bounds read of the valid Cisco Discovery Protocol packet data, which could allow the attacker to cause corruption in the internal Cisco Discovery Protocol database of the affected device. Múltiples vulnerabilidades en la funcionalidad Cisco Discovery Protocol del firmware del adaptador de teléfono analógico Cisco ATA serie 190 podrían permitir que un atacante adyacente no autenticado cause daños en la memoria del Cisco Discovery Protocol en un dispositivo afectado. Estas vulnerabilidades se deben a que faltan verificaciones de validación de longitud al procesar mensajes del Protocolo de descubrimiento de Cisco. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multivuln-GEZYVvs • CWE-130: Improper Handling of Length Parameter Inconsistency CWE-1284: Improper Validation of Specified Quantity in Input •
CVSS: 8.8EPSS: 0%CPEs: 13EXPL: 0CVE-2022-20689
https://notcve.org/view.php?id=CVE-2022-20689
Multiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, adjacent attacker to cause Cisco Discovery Protocol memory corruption on an affected device. These vulnerabilities are due to missing length validation checks when processing Cisco Discovery Protocol messages. An attacker could exploit these vulnerabilities by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause an out-of-bounds read of the valid Cisco Discovery Protocol packet data, which could allow the attacker to cause corruption in the internal Cisco Discovery Protocol database of the affected device. Múltiples vulnerabilidades en la funcionalidad Cisco Discovery Protocol del firmware del adaptador de teléfono analógico Cisco ATA serie 190 podrían permitir que un atacante adyacente no autenticado cause daños en la memoria del Cisco Discovery Protocol en un dispositivo afectado. Estas vulnerabilidades se deben a que faltan verificaciones de validación de longitud al procesar mensajes del Protocolo de descubrimiento de Cisco. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multivuln-GEZYVvs • CWE-130: Improper Handling of Length Parameter Inconsistency CWE-1284: Improper Validation of Specified Quantity in Input •
CVSS: 5.3EPSS: 0%CPEs: 13EXPL: 0CVE-2022-20688
https://notcve.org/view.php?id=CVE-2022-20688
A vulnerability in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device and cause Cisco Discovery Protocol service to restart. This vulnerability is due to missing length validation of certain Cisco Discovery Protocol packet header fields. An attacker could exploit these vulnerabilities by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to execute code on the affected device and cause Cisco Discovery Protocol to restart unexpectedly, resulting in a DoS condition. Una vulnerabilidad en la funcionalidad Cisco Discovery Protocol del firmware del adaptador de teléfono analógico Cisco ATA serie 190 podría permitir que un atacante remoto no autenticado ejecute código arbitrario en un dispositivo afectado y provocar que el servicio Cisco Discovery Protocol se reinicie. Esta vulnerabilidad se debe a la falta de validación de longitud de ciertos campos de encabezado de paquetes de Cisco Discovery Protocol. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multivuln-GEZYVvs • CWE-125: Out-of-bounds Read CWE-1284: Improper Validation of Specified Quantity in Input •
CVSS: 5.3EPSS: 0%CPEs: 13EXPL: 0CVE-2022-20687
https://notcve.org/view.php?id=CVE-2022-20687
Multiple vulnerabilities in the Link Layer Discovery Protocol (LLDP) functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device and cause the LLDP service to restart. These vulnerabilities are due to missing length validation of certain LLDP packet header fields. An attacker could exploit these vulnerabilities by sending a malicious LLDP packet to an affected device. A successful exploit could allow the attacker to execute code on the affected device and cause LLDP to restart unexpectedly, resulting in a denial of service (DoS) condition. Múltiples vulnerabilidades en la funcionalidad del Link Layer Discovery Protocol (LLDP) del firmware del Cisco ATA 190 Series Analog Telephone Adapter podrían permitir que un atacante remoto no autenticado ejecute código arbitrario en un dispositivo afectado y provoque que el servicio LLDP se reinicie. Estas vulnerabilidades se deben a la falta de validación de longitud de ciertos campos de encabezado de paquetes LLDP. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multivuln-GEZYVvs • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-1284: Improper Validation of Specified Quantity in Input •