Cisco ATA 190 Series Analog Telephone Adapter Muliplatform Firmware Information Disclosure Vulnerability (Cisco Cisco Analog Telephone Adaptor (ATA) Software)

CVE-2024-20462

MEDIUM 5.5

At a glance

Source: NVD
EPSS: EPSS 0.16 % · percentile 5 (2026-10-31)
State: PUBLISHED
Published: 2024-10-16 16:16 UTC
Updated: 2024-10-31 13:17 UTC
Assigner: cisco
NVD status: Modified

Search on…

Description

A vulnerability in the web-based management interface of Cisco ATA 190 Series Multiplatform Analog Telephone Adapter firmware could allow an authenticated, local attacker with low privileges to view passwords on an affected device. This vulnerability is due to incorrect sanitization of HTML content from an affected device. A successful exploit could allow the attacker to view passwords that belong to other users.

Weaknesses (CWE)

CWE-257 — Storing Passwords in a Recoverable Format
CWE-922 — Insecure Storage of Sensitive Information
CWE-522 — Insufficiently Protected Credentials

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy

Scores

Version	Score	Vector	Scored by
CVSS 3.1	MEDIUM 5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	cisco
CVSS 3.1	MEDIUM 5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	NVD · psirt@cisco.com (Secondary)
CVSS 3.1	MEDIUM 5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	NVD · nvd@nist.gov (Primary)

European references

ENISA EUVD · EUVD-2024-18177
GCVE · GCVE-0-2024-20462

CERT-FR advisories

CERTFR-2024-AVI-0897 — Multiples vulnérabilités dans les produits Cisco · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:o:cisco:ata_191_firmware:*:*:*:*:*:*:*:* < 12.0.2
cpe:2.3:o:cisco:ata_191_firmware:*:*:*:*:*:*:*:* < 11.2.5
cpe:2.3:o:cisco:ata_192_firmware:*:*:*:*:*:*:*:* < 11.2.5

Affected products

Product	Versions
Cisco · Cisco Analog Telephone Adaptor (ATA) Software	affected 11.1.0 ; affected 11.1.0 MSR1 ; affected 11.1.0 MSR2 ; affected 11.1.0 MSR3 ; affected 11.1.0 MSR4 ; affected 11.2.1

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

🟡 Cisco ATA 190 Series Analog Telephone Adapter Muliplatform Firmware Information Disclosure Vulnerability (Cisco Cisco Analog Telephone Adaptor (ATA) Software)