CVE-2022-20688

A vulnerability in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device and cause Cisco Discovery Protocol service to restart.
 This vulnerability is due to missing length validation of certain Cisco Discovery Protocol packet header fields. An attacker could exploit these vulnerabilities by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to execute code on the affected device and cause Cisco Discovery Protocol to restart unexpectedly, resulting in a DoS condition.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
ciscoCNA
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 16%
VendorProductVersion
ciscoata_190_firmware
-
ciscoata_191_firmware
𝑥
< 11.2.2
ciscoata_191_firmware
𝑥
< 12.0.1
ciscoata_191_firmware
12.0.1
ciscoata_191_firmware
12.0.1:sr1
ciscoata_191_firmware
12.0.1:sr2
ciscoata_191_firmware
12.0.1:sr3
ciscoata_191_firmware
12.0.1:sr4
ciscoata_192_firmware
𝑥
< 11.2.2
𝑥
= Vulnerable software versions