CVE-2022-20691: Cisco Security Advisory: Cisco ATA 190 Series Analog Telephone Adapter Software Vulnerabilities

The vulnerabilities are not dependent on one another. Exploitation of one of the vulnerabilities is not required to exploit the other vulnerability. In addition, a firmware release that is affected by one of the vulnerabilities may not be affected by the other vulnerability.

Details about the vulnerabilities are as follows:

CVE-2022-20686, CVE-2022-20687: Cisco ATA 190 Series Analog Telephone Adapter Link Layer Discovery Protocol Firmware Denial of Service Vulnerabilities

Multiple vulnerabilities in the Link Layer Discovery Protocol (LLDP) functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device and cause the LLDP service to restart.

These vulnerabilities are due to missing length validation of certain LLDP packet header fields. An attacker could exploit these vulnerabilities by sending a malicious LLDP packet to an affected device. A successful exploit could allow the attacker to execute code on the affected device and cause LLDP to restart unexpectedly, resulting in a denial of service (DoS) condition.

Cisco has released firmware updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.

Bug ID(s): CSCvz93493, CSCvz91984, CSCvz93504
CVE ID: CVE-2022-20686, CVE-2022-20687
Security Impact Rating (SIR): Medium
CVSS Base Score: 5.3
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-20688: Cisco ATA 190 Series Analog Telephone Adapter Cisco Discovery Protocol Firmware Denial of Service Vulnerability

A vulnerability in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device and cause Cisco Discovery Protocol service to restart.

This vulnerability is due to missing length validation of certain Cisco Discovery Protocol packet header fields. An attacker could exploit these vulnerabilities by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to execute code on the affected device and cause Cisco Discovery Protocol to restart unexpectedly, resulting in a DoS condition.

Cisco has released firmware updates that address this vulnerability. There are no workarounds that address this vulnerability.

Bug ID(s): CSCvz93493, CSCvz91984, CSCvz93504
CVE ID: CVE-2022-20688
Security Impact Rating (SIR): Medium
CVSS Base Score: 5.3
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-20689, CVE-2022-20690: Cisco ATA 190 Series Analog Telephone Adapter Cisco Discovery Protocol Firmware Command Injection Vulnerabilities

Multiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, adjacent attacker to cause Cisco Discovery Protocol memory corruption on an affected device.

These vulnerabilities are due to missing length validation checks when processing Cisco Discovery Protocol messages. An attacker could exploit these vulnerabilities by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause an out-of-bounds read of the valid Cisco Discovery Protocol packet data, which could allow the attacker to cause corruption in the internal Cisco Discovery Protocol database of the affected device.

Cisco has released firmware updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.

Bug ID(s): CSCvz93493, CSCvz91984, CSCvz93504
CVE ID: CVE-2022-20689, CVE-2022-20690
Security Impact Rating (SIR): Medium
CVSS Base Score: 5.3
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVE-2022-20691: Cisco ATA 190 Series Analog Telephone Adapter Firmware Cisco Discovery Protocol Denial of Service Vulnerability

A vulnerability in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Adaptive Telephone Adapter firmware could allow an unauthenticated, adjacent attacker to cause a DoS condition of an affected device.

This vulnerability is due to missing length validation of certain Cisco Discovery Protocol packet header fields. An attacker could exploit this vulnerability by sending crafted Cisco Discovery Protocol packets to an affected device. A successful exploit could allow the attacker to cause the device to exhaust available memory and cause the service to restart.

Cisco has released firmware updates that address this vulnerability. There are no workarounds that address this vulnerability.

Bug ID(s):CSCwa24837,CSCwa24842
CVE ID: CVE-2022-20691
Security Impact Rating (SIR): Medium
CVSS Base Score: 5.3
CVSS Vector:

CVE-2022-20766: Cisco ATA 190 Series Analog Telephone Adapter Firmware Cisco Discovery Protocol Denial of Service Vulnerability

A vulnerability in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Adaptive Telephone Adapter firmware could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.

This vulnerability is due to an out-of-bounds read when processing Cisco Discovery Protocol packets. An attacker could exploit this vulnerability by sending crafted Cisco Discovery Protocol packets to an affected device. A successful exploit could allow the attacker to cause a service restart.

Cisco has released firmware updates that address this vulnerability. There are no workarounds that address this vulnerability.

Bug ID(s): CSCwa24844, CSCwa24849
CVE ID: CVE-2022-20766
Security Impact Rating (SIR): Medium
CVSS Base Score: 5.3
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L