CVE-2024-20461— Cisco ATA 190 操作系统命令注入漏洞

Cisco ATA 190 Series Analog Telephone Adapter Firmware Command Injection Vulnerability

A vulnerability in the CLI of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an authenticated, local attacker with high privileges to execute arbitrary commands as the root user. This vulnerability exists because CLI input is not properly sanitized. An attacker could exploit this vulnerability by sending malicious characters to the CLI. A successful exploit could allow the attacker to read and write to the underlying operating system as the root user.

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Cisco ATA 190 操作系统命令注入漏洞

Cisco ATA 190是美国思科（Cisco）公司的一个模拟电话适配器。 Cisco ATA 190存在操作系统命令注入漏洞，该漏洞源于CLI 输入未经过正确清理。经过身份验证且具有高权限的本地攻击者利用该漏洞可以以root用户身份执行任意命令。

N/A

N/A