Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.2

Cisco ATA 190 Series: Unauthenticated access to configuration and firmware

CVE-2024-20458 · published 2 years ago
Summary

An attacker can access and delete configuration or change the firmware of Cisco ATA 190 devices without a password. This could allow an attacker to disrupt service or gain unauthorized control. Cisco recommends updating the firmware to a fixed version to prevent this issue.

What to do
  • Update cisco ata_192_firmware to version 11.2.5 or later.
Affected software
VendorProductAffected versions
cisco ata_191_firmware < 12.0.2
< 11.2.5
cpe:2.3:o:cisco:ata_191_firmware:*:*:*:*:*:*:*:*
cisco ata_192_firmware < 11.2.5
cpe:2.3:o:cisco:ata_192_firmware:*:*:*:*:*:*:*:*
Original advisory text
A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to view or delete the configuration o...
A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to view or delete the configuration or change the firmware on an affected device.

This vulnerability is due to a lack of authentication on specific HTTP endpoints. An attacker could exploit this vulnerability by browsing to a specific URL. A successful exploit could allow the attacker to view or delete the configuration or change the firmware.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.2 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published16 Oct 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-20458 · NVD
Track software like this
Free during beta