cve-2022-20766
Vulnerability from cvelistv5
Published
2024-11-15 15:35
Modified
2024-11-15 21:07
Severity ?
EPSS score ?
Summary
Cisco ATA 190 Series Analog Telephone Adapter firmware Cisco Discovery Protocol Denial of Service Vulnerability
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco Analog Telephone Adaptor (ATA) Software |
Version: 2.16(1) Version: 2.16(2) Version: 2.1(6) Version: 2.14 Version: 3.2(0) Version: 1.1(4) Version: 2.1(5) Version: 3.2(1) Version: 2.15 Version: 1.0(0) Version: 1.34 Version: 3.1(1) Version: 3.2(4) Version: 3.0(0) Version: 3.2(3) Version: 3.1(0) Version: 3.1(2) Version: 1.2.1 Version: 1.2.2 Version: 1.2.2 SR1 Version: 1.1.2 Version: 1.1.0 Version: 1.1.1 Version: 9.0(3) Version: 9.2(3) Version: 9.2(1) Version: 12.0.1 SR2 Version: 11.1.0 Version: 12.0.1 SR1 Version: 11.1.0 MSR1 Version: 12.0.1 Version: 11.1.0 MSR2 Version: 11.1.0 MSR3 Version: 1.2.2 SR2 Version: 11.1.0 MSR4 Version: 12.0.1 SR3 Version: 11.2.1 Version: 12.0.1 SR4 |
|
|
|||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:cisco:ata_190_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ata_190_firmware",
"vendor": "cisco",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-20766",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-15T21:01:50.788004Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-15T21:07:11.500Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco Analog Telephone Adaptor (ATA) Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "2.16(1)"
},
{
"status": "affected",
"version": "2.16(2)"
},
{
"status": "affected",
"version": "2.1(6)"
},
{
"status": "affected",
"version": "2.14"
},
{
"status": "affected",
"version": "3.2(0)"
},
{
"status": "affected",
"version": "1.1(4)"
},
{
"status": "affected",
"version": "2.1(5)"
},
{
"status": "affected",
"version": "3.2(1)"
},
{
"status": "affected",
"version": "2.15"
},
{
"status": "affected",
"version": "1.0(0)"
},
{
"status": "affected",
"version": "1.34"
},
{
"status": "affected",
"version": "3.1(1)"
},
{
"status": "affected",
"version": "3.2(4)"
},
{
"status": "affected",
"version": "3.0(0)"
},
{
"status": "affected",
"version": "3.2(3)"
},
{
"status": "affected",
"version": "3.1(0)"
},
{
"status": "affected",
"version": "3.1(2)"
},
{
"status": "affected",
"version": "1.2.1"
},
{
"status": "affected",
"version": "1.2.2"
},
{
"status": "affected",
"version": "1.2.2 SR1"
},
{
"status": "affected",
"version": "1.1.2"
},
{
"status": "affected",
"version": "1.1.0"
},
{
"status": "affected",
"version": "1.1.1"
},
{
"status": "affected",
"version": "9.0(3)"
},
{
"status": "affected",
"version": "9.2(3)"
},
{
"status": "affected",
"version": "9.2(1)"
},
{
"status": "affected",
"version": "12.0.1 SR2"
},
{
"status": "affected",
"version": "11.1.0"
},
{
"status": "affected",
"version": "12.0.1 SR1"
},
{
"status": "affected",
"version": "11.1.0 MSR1"
},
{
"status": "affected",
"version": "12.0.1"
},
{
"status": "affected",
"version": "11.1.0 MSR2"
},
{
"status": "affected",
"version": "11.1.0 MSR3"
},
{
"status": "affected",
"version": "1.2.2 SR2"
},
{
"status": "affected",
"version": "11.1.0 MSR4"
},
{
"status": "affected",
"version": "12.0.1 SR3"
},
{
"status": "affected",
"version": "11.2.1"
},
{
"status": "affected",
"version": "12.0.1 SR4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the Cisco\u0026nbsp;Discovery Protocol functionality of Cisco\u0026nbsp;ATA 190 Series Adaptive Telephone Adapter firmware could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.\r\nThis vulnerability is due to an out-of-bounds read when processing Cisco\u0026nbsp;Discovery Protocol packets. An attacker could exploit this vulnerability by sending crafted Cisco\u0026nbsp;Discovery Protocol packets to an affected device. A successful exploit could allow the attacker to cause a service restart.Cisco\u0026nbsp;has released firmware updates that address this vulnerability. There are no workarounds that address this vulnerability."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco\u00a0PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-15T15:35:42.433Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-ata19x-multivuln-GEZYVvs",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multivuln-GEZYVvs"
}
],
"source": {
"advisory": "cisco-sa-ata19x-multivuln-GEZYVvs",
"defects": [
"CSCwa24849"
],
"discovery": "EXTERNAL"
},
"title": "Cisco ATA 190 Series Analog Telephone Adapter firmware Cisco Discovery Protocol Denial of Service Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2022-20766",
"datePublished": "2024-11-15T15:35:42.433Z",
"dateReserved": "2021-11-02T13:28:29.102Z",
"dateUpdated": "2024-11-15T21:07:11.500Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2022-20766\",\"sourceIdentifier\":\"ykramarz@cisco.com\",\"published\":\"2024-11-15T16:15:22.133\",\"lastModified\":\"2024-11-18T17:11:56.587\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in the Cisco\u0026nbsp;Discovery Protocol functionality of Cisco\u0026nbsp;ATA 190 Series Adaptive Telephone Adapter firmware could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.\\r\\nThis vulnerability is due to an out-of-bounds read when processing Cisco\u0026nbsp;Discovery Protocol packets. An attacker could exploit this vulnerability by sending crafted Cisco\u0026nbsp;Discovery Protocol packets to an affected device. A successful exploit could allow the attacker to cause a service restart.Cisco\u0026nbsp;has released firmware updates that address this vulnerability. There are no workarounds that address this vulnerability.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en la funcionalidad Cisco Discovery Protocol del firmware del adaptador telef\u00f3nico adaptable Cisco ATA 190 Series podr\u00eda permitir que un atacante remoto no autenticado provoque una condici\u00f3n de denegaci\u00f3n de servicio en un dispositivo afectado. Esta vulnerabilidad se debe a una lectura fuera de los l\u00edmites al procesar paquetes Cisco Discovery Protocol. Un atacante podr\u00eda aprovechar esta vulnerabilidad enviando paquetes Cisco Discovery Protocol manipulados a un dispositivo afectado. Una explotaci\u00f3n exitosa podr\u00eda permitir que el atacante provoque un reinicio del servicio. Cisco ha publicado actualizaciones de firmware que solucionan esta vulnerabilidad. No existen workarounds que solucionen esta vulnerabilidad.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"ykramarz@cisco.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"ykramarz@cisco.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"references\":[{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multivuln-GEZYVvs\",\"source\":\"ykramarz@cisco.com\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.