CVE-2022-20689 Memory corruption in Cisco Analog Telephone Adaptor (ATA) Software
An unauthenticated adjacent attacker can cause memory corruption and potential information disclosure on Cisco ATA devices by sending malicious CDP packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-20689?
CVE-2022-20689 is a medium-severity memory corruption vulnerability in Cisco Analog Telephone Adaptor (ATA) Software, published on 7 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, adjacent attacker to cause Cisco Discovery Protocol memory corruption on an affected device. These vulnerabilities are due to missing length validation checks when processing Cisco Discovery Protocol messages. An attacker could exploit these vulnerabilities by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause an out-of-bounds read of the valid Cisco Discovery Protocol packet data, which could allow the attacker to cause corruption in the internal Cisco Discovery Protocol database of the affected device.
Which versions are affected by CVE-2022-20689?
It affects 3 products.
Products include Cisco Ata 190 Firmware, Cisco Ata 191 Firmware, Cisco Ata 192 Firmware.
How do I fix CVE-2022-20689?
No fix has been published for CVE-2022-20689 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-20689 being exploited?
There is no known exploitation of CVE-2022-20689 in the wild and no public exploit code.
Other vulnerabilities in Cisco Analog Telephone Adaptor (ATA) Software
- CVE-2021-34710 Cisco ATA 190 Series Analog Telephone Adapter Software Vulnerabilities
- CVE-2021-34735 Cisco ATA 190 Series Analog Telephone Adapter Software Vulnerabilities
- CVE-2022-20686 Memory corruption in Cisco Analog Telephone Adaptor (ATA) Software
- CVE-2022-20687 Memory corruption in Cisco Analog Telephone Adaptor (ATA) Software
- CVE-2022-20688 Memory corruption in Cisco Analog Telephone Adaptor (ATA) Software
Sources
Also known as GHSA-8pwq-5wx2-r2fc.