Vulnerabilities > Cisco

DATE CVE VULNERABILITY TITLE RISK
2024-10-16 CVE-2024-20458 OS Command Injection vulnerability in Cisco ATA 191 Firmware and ATA 192 Firmware
A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to view or delete the configuration or change the firmware on an affected device. This vulnerability is due to a lack of authentication on specific HTTP endpoints.
network
low complexity
cisco CWE-78
8.2
2024-10-16 CVE-2024-20459 OS Command Injection vulnerability in Cisco ATA 191 Firmware and ATA 192 Firmware
A vulnerability in the web-based management interface of Cisco ATA 190 Multiplatform Series Analog Telephone Adapter firmware could allow an authenticated, remote attacker with high privileges to execute arbitrary commands as the root user on the underlying operating system. This vulnerability is due to a lack of input sanitization in the web-based management interface.
network
low complexity
cisco CWE-78
7.2
2024-10-16 CVE-2024-20460 Unspecified vulnerability in Cisco ATA 191 Firmware and ATA 192 Firmware
A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user. This vulnerability is due to insufficient validation of user input.
network
low complexity
cisco
6.1
2024-10-16 CVE-2024-20461 OS Command Injection vulnerability in Cisco ATA 191 Firmware and ATA 192 Firmware
A vulnerability in the CLI of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an authenticated, local attacker with high privileges to execute arbitrary commands as the root user. This vulnerability exists because CLI input is not properly sanitized.
local
low complexity
cisco CWE-78
6.0
2024-10-16 CVE-2024-20462 Insufficiently Protected Credentials vulnerability in Cisco ATA 191 Firmware and ATA 192 Firmware
A vulnerability in the web-based management interface of Cisco ATA 190 Series Multiplatform Analog Telephone Adapter firmware could allow an authenticated, local attacker with low privileges to view passwords on an affected device. This vulnerability is due to incorrect sanitization of HTML content from an affected device.
local
low complexity
cisco CWE-522
5.5
2024-10-16 CVE-2024-20463 Unspecified vulnerability in Cisco ATA 191 Firmware and ATA 192 Firmware
A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to modify the configuration or reboot an affected device. This vulnerability is due to the HTTP server allowing state changes in GET requests.
network
low complexity
cisco
7.1
2024-10-02 CVE-2024-20498 Double Free vulnerability in Cisco products
Multiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition in the AnyConnect service on an affected device. These vulnerabilities are due to insufficient validation of client-supplied parameters while establishing an SSL VPN session.
network
low complexity
cisco CWE-415
7.5
2024-10-02 CVE-2024-20499 Out-of-bounds Write vulnerability in Cisco products
Multiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition in the AnyConnect service on an affected device. These vulnerabilities are due to insufficient validation of client-supplied parameters while establishing an SSL VPN session.
network
low complexity
cisco CWE-787
7.5
2024-10-02 CVE-2024-20500 Resource Exhaustion vulnerability in Cisco products
A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition in the AnyConnect service on an affected device. This vulnerability is due to insufficient resource management when establishing TLS/SSL sessions.
network
low complexity
cisco CWE-400
7.5
2024-10-02 CVE-2024-20501 Out-of-bounds Write vulnerability in Cisco products
Multiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition in the AnyConnect service on an affected device. These vulnerabilities are due to insufficient validation of client-supplied parameters while establishing an SSL VPN session.
network
low complexity
cisco CWE-787
7.5