CVE-2024-20420
Published: 16 October 2024
Summary
CVE-2024-20420 is a medium-severity Execution with Unnecessary Privileges (CWE-250) vulnerability in Cisco Ata 191 Firmware. Its CVSS base score is 5.4 (Medium).
Operationally, ranked in the top 43.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-18135
Vulnerability details
A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an authenticated, remote attacker with low privileges to run commands as an Admin user. This vulnerability is due to incorrect authorization verification…
more
by the HTTP server. An attacker could exploit this vulnerability by sending a malicious request to the web-based management interface. A successful exploit could allow the attacker to run commands as the Admin user.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Periodic review and update of procedures reduces incorrect authorization implementations over time.
Supervision identifies cases where authorization logic incorrectly permits unauthorized actions.
Reviewing accounts for compliance, disabling/removing unneeded accounts, and aligning with termination processes prevents execution with unnecessary privileges.
Periodic review and documentation of connection needs reduces incorrect authorization.
The control requires correct implementation of authorization specifically tied to change operations.
Authorization reviews within the risk management program detect and prevent incorrect authorization logic or policy enforcement before systems receive approval to operate.
Insider threat program enforces least-privilege reviews and monitors privileged actions, directly reducing abuse of unnecessary rights.
Org-wide risk executive function provides accountability and oversight that directly reduces execution with unnecessary privileges through consistent identification and mitigation.