// For flags

CVE-2022-20688

 

Severity Score

5.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device and cause Cisco Discovery Protocol service to restart.
This vulnerability is due to missing length validation of certain Cisco Discovery Protocol packet header fields. An attacker could exploit these vulnerabilities by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to execute code on the affected device and cause Cisco Discovery Protocol to restart unexpectedly, resulting in a DoS condition.

Una vulnerabilidad en la funcionalidad Cisco Discovery Protocol del firmware del adaptador de teléfono analógico Cisco ATA serie 190 podría permitir que un atacante remoto no autenticado ejecute código arbitrario en un dispositivo afectado y provocar que el servicio Cisco Discovery Protocol se reinicie. Esta vulnerabilidad se debe a la falta de validación de longitud de ciertos campos de encabezado de paquetes de Cisco Discovery Protocol. Un atacante podría aprovechar estas vulnerabilidades enviando un paquete malicioso del Protocolo de descubrimiento de Cisco a un dispositivo afectado. Un exploit exitoso podría permitir al atacante ejecutar código en el dispositivo afectado y provocar que Cisco Discovery Protocol se reinicie inesperadamente, lo que resultaría en una condición DoS.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-11-02 CVE Reserved
  • 2022-12-07 CVE Published
  • 2024-06-29 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-125: Out-of-bounds Read
  • CWE-1284: Improper Validation of Specified Quantity in Input
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
Ata 190 Firmware
Search vendor "Cisco" for product "Ata 190 Firmware"
-on-premises
Affected
in Cisco
Search vendor "Cisco"
Ata 190
Search vendor "Cisco" for product "Ata 190"
-on-premises
Safe
Cisco
Search vendor "Cisco"
Ata 191 Firmware
Search vendor "Cisco" for product "Ata 191 Firmware"
< 11.2.2
Search vendor "Cisco" for product "Ata 191 Firmware" and version " < 11.2.2"
multiplatform
Affected
in Cisco
Search vendor "Cisco"
Ata 191
Search vendor "Cisco" for product "Ata 191"
-multiplatform
Safe
Cisco
Search vendor "Cisco"
Ata 191 Firmware
Search vendor "Cisco" for product "Ata 191 Firmware"
< 12.0.1
Search vendor "Cisco" for product "Ata 191 Firmware" and version " < 12.0.1"
on-premises
Affected
in Cisco
Search vendor "Cisco"
Ata 191
Search vendor "Cisco" for product "Ata 191"
-on-premises
Safe
Cisco
Search vendor "Cisco"
Ata 191 Firmware
Search vendor "Cisco" for product "Ata 191 Firmware"
12.0.1
Search vendor "Cisco" for product "Ata 191 Firmware" and version "12.0.1"
on-premises
Affected
in Cisco
Search vendor "Cisco"
Ata 191
Search vendor "Cisco" for product "Ata 191"
-on-premises
Safe
Cisco
Search vendor "Cisco"
Ata 191 Firmware
Search vendor "Cisco" for product "Ata 191 Firmware"
12.0.1
Search vendor "Cisco" for product "Ata 191 Firmware" and version "12.0.1"
sr1, on-premises
Affected
in Cisco
Search vendor "Cisco"
Ata 191
Search vendor "Cisco" for product "Ata 191"
-on-premises
Safe
Cisco
Search vendor "Cisco"
Ata 191 Firmware
Search vendor "Cisco" for product "Ata 191 Firmware"
12.0.1
Search vendor "Cisco" for product "Ata 191 Firmware" and version "12.0.1"
sr2, on-premises
Affected
in Cisco
Search vendor "Cisco"
Ata 191
Search vendor "Cisco" for product "Ata 191"
-on-premises
Safe
Cisco
Search vendor "Cisco"
Ata 191 Firmware
Search vendor "Cisco" for product "Ata 191 Firmware"
12.0.1
Search vendor "Cisco" for product "Ata 191 Firmware" and version "12.0.1"
sr3, on-premises
Affected
in Cisco
Search vendor "Cisco"
Ata 191
Search vendor "Cisco" for product "Ata 191"
-on-premises
Safe
Cisco
Search vendor "Cisco"
Ata 191 Firmware
Search vendor "Cisco" for product "Ata 191 Firmware"
12.0.1
Search vendor "Cisco" for product "Ata 191 Firmware" and version "12.0.1"
sr4, on-premises
Affected
in Cisco
Search vendor "Cisco"
Ata 191
Search vendor "Cisco" for product "Ata 191"
-on-premises
Safe
Cisco
Search vendor "Cisco"
Ata 192 Firmware
Search vendor "Cisco" for product "Ata 192 Firmware"
< 11.2.2
Search vendor "Cisco" for product "Ata 192 Firmware" and version " < 11.2.2"
multiplatform
Affected
in Cisco
Search vendor "Cisco"
Ata 192
Search vendor "Cisco" for product "Ata 192"
-multiplatform
Safe