CVE-2024-20459— Cisco ATA 190 Series Analog Telephone Adapter Muliplatform Firmware Command Injection Vulnerability

Cisco ATA 190 Series Analog Telephone Adapter Muliplatform Firmware Command Injection Vulnerability

A vulnerability in the web-based management interface of Cisco ATA 190 Multiplatform Series Analog Telephone Adapter firmware could allow an authenticated, remote attacker with high privileges to execute arbitrary commands as the root user on the underlying operating system. This vulnerability is due to a lack of input sanitization in the web-based management interface. An attacker could exploit this vulnerability by sending a malicious request to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Cisco ATA 190 操作系统命令注入漏洞

Cisco ATA 190是美国思科（Cisco）公司的一个模拟电话适配器。 Cisco ATA 190存在操作系统命令注入漏洞，该漏洞源于 Web 管理界面缺乏输入清理。经过身份验证且具有高权限的远程攻击者利用该漏洞可以以root用户身份在底层操作系统上执行任意命令。

N/A

N/A