CVE-2024-20420
CVE-2024-20420 is a medium-severity vulnerability in Cisco Ata 191 Firmware with a CVSS 3.x base score of 5.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-250.
Key facts
- Severity: Medium (CVSS 3.x base score 5.4)
- EPSS exploit prediction: 0% (28th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2024-18135
- Weakness: CWE-250
- Affected product: Cisco Ata 191 Firmware
- Published:
- Last modified:
Description
A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an authenticated, remote attacker with low privileges to run commands as an Admin user. This vulnerability is due to incorrect authorization verification by the HTTP server. An attacker could exploit this vulnerability by sending a malicious request to the web-based management interface. A successful exploit could allow the attacker to run commands as the Admin user.
Frequently asked questions
- What is CVE-2024-20420?
- A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an authenticated, remote attacker with low privileges to run commands as an Admin user. This vulnerability is due to incorrect authorization verification by the HTTP server. An attacker could exploit this vulnerability by sending a malicious request to the web-based management interface. A successful exploit could allow the attacker to run commands as the Admin user.
- How severe is CVE-2024-20420?
- CVE-2024-20420 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
- Is CVE-2024-20420 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (28th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2024-20420?
- CVE-2024-20420 primarily affects Cisco Ata 191 Firmware. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2024-20420?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2024-20420 have an EU (EUVD) identifier?
- Yes. CVE-2024-20420 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-18135.
- When was CVE-2024-20420 published?
- CVE-2024-20420 was published on 2024-10-16 and last updated on 2026-06-17.
References
Affected products (2)
- cpe:2.3:o:cisco:ata_191_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ata_192_firmware:*:*:*:*:*:*:*:*
More vulnerabilities in Cisco Ata 191 Firmware
- CVE-2021-34735 — High (CVSS 8.8): Multiple vulnerabilities in the Cisco ATA 190 Series Analog Telephone Adapter Software could allow an attacker to…
- CVE-2021-34710 — High (CVSS 8.8): Multiple vulnerabilities in the Cisco ATA 190 Series Analog Telephone Adapter Software could allow an attacker to…
- CVE-2024-20458 — High (CVSS 8.2): A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could…
- CVE-2024-20421 — High (CVSS 7.1): A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could…
- CVE-2024-20459 — Medium (CVSS 6.5): A vulnerability in the web-based management interface of Cisco ATA 190 Multiplatform Series Analog Telephone Adapter…
- CVE-2024-20460 — Medium (CVSS 6.1): A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could…
All CVEs affecting Cisco Ata 191 Firmware →
Other CWE-250 vulnerabilities
- CVE-2026-4606 — Critical (CVSS 10.0): GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing…
- CVE-2022-2634 — Critical (CVSS 10.0): An attacker may be able to execute malicious actions due to the lack of device access protections and device…
- CVE-2026-48584 — Critical (CVSS 9.9): Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate privileges over a…
- CVE-2026-50566 — Critical (CVSS 9.9): Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and…
- CVE-2026-44477 — Critical (CVSS 9.9): CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.29.1 and…
- CVE-2026-25212 — Critical (CVSS 9.9): An issue was discovered in Percona PMM before 3.7. Because an internal database user retains specific superuser…