CVE-2024-20420: Cisco ATA 191 Auth Bypass Vulnerability

CVE-2024-20420 Overview

CVE-2024-20420 is a privilege escalation vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware. The flaw allows an authenticated, remote attacker holding low-privilege credentials to execute commands as the Admin user. The root cause is incorrect authorization verification in the HTTP server component, mapped to [CWE-863] (Incorrect Authorization) and [CWE-250] (Execution with Unnecessary Privileges). Cisco published a security advisory tracking this issue alongside related ATA 19x defects.

Critical Impact
A low-privilege authenticated user can send a crafted HTTP request to the management interface and gain full Admin-level command execution on affected ATA devices.

Affected Products

Cisco ATA 191 Analog Telephone Adapter (on-premises and multiplatform firmware)
Cisco ATA 192 Analog Telephone Adapter (multiplatform firmware)
Cisco ATA 191 / ATA 192 firmware images distributed prior to Cisco's fixed release

Discovery Timeline

2024-10-16 - CVE-2024-20420 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20420

Vulnerability Analysis

The vulnerability resides in the HTTP server that backs the ATA 190 Series web management interface. The server authenticates incoming users but fails to enforce role-based authorization on privileged endpoints. As a result, a session bound to a low-privilege account can invoke administrative operations reserved for the Admin role.

Successful exploitation grants the attacker the ability to run commands as Admin. This includes changes to device configuration, call routing behavior, credentials, and firmware settings. Because ATA devices bridge analog telephony to VoIP infrastructure, Admin-level control can be used to intercept, redirect, or disrupt voice traffic.

The vulnerability requires network reachability to the management interface and valid low-privilege credentials. It does not require user interaction, and exploitation complexity is low.

Root Cause

The HTTP server performs authentication but omits or incorrectly evaluates authorization checks on administrative request handlers. This is a classic [CWE-863] pattern where role verification is either absent, evaluated against the wrong identity attribute, or bypassable through direct request submission. The affected handlers also run with elevated privilege ([CWE-250]), which amplifies the impact of the authorization gap.

Attack Vector

An attacker authenticates to the web interface with any valid low-privilege account. The attacker then submits a malicious HTTP request directly to an administrative endpoint. Because the server does not confirm the caller holds the Admin role, the request executes with Admin authority. No client-side controls or UI restrictions prevent this because the vulnerable check is missing on the server side.

Refer to the Cisco Security Advisory cisco-sa-ata19x-multi-RDTEqRsy for vendor technical details. No public proof-of-concept code is available at the time of publication.

Detection Methods for CVE-2024-20420

Indicators of Compromise

Successful HTTP or HTTPS requests to administrative paths on the ATA web interface originating from non-Admin user sessions.
Unexpected configuration changes on ATA 191 or ATA 192 devices, including modified SIP registrars, dial plans, or user credentials.
New or altered administrator accounts appearing in device logs without a corresponding change ticket.

Detection Strategies

Correlate authentication logs from ATA devices with subsequent privileged action events to identify role mismatch patterns.
Baseline expected management traffic sources and alert on management-interface access from unexpected subnets or hosts.
Inspect device syslog and configuration audit output for out-of-band configuration writes performed by non-Admin accounts.

Monitoring Recommendations

Forward ATA syslog and web management access logs to a centralized SIEM for retention and correlation.
Monitor for repeated authentication attempts followed by administrative HTTP POST or PUT requests within the same session.
Track firmware version and configuration hash drift across the ATA fleet to detect unauthorized changes.

How to Mitigate CVE-2024-20420

Immediate Actions Required

Apply the fixed firmware release published in the Cisco Security Advisory cisco-sa-ata19x-multi-RDTEqRsy to all ATA 191 and ATA 192 devices.
Restrict access to the web-based management interface to a dedicated management VLAN or trusted jump host.
Rotate credentials for all user and Admin accounts on affected ATA devices after patching.

Patch Information

Cisco has released fixed firmware for the ATA 190 Series. Consult the vendor advisory for the exact fixed version applicable to your on-premises or multiplatform firmware track, and validate the release train against your current deployment before scheduling the upgrade.

Workarounds

Cisco has not published a specific workaround. Access controls that block untrusted networks from reaching the management interface reduce exposure but do not remove the underlying flaw.
Disable unused low-privilege accounts and enforce strong, unique passwords to reduce the likelihood of credential-based access.
Place ATA devices behind a firewall or ACL that permits management traffic only from authorized administrator workstations.

bash

# Example Cisco IOS ACL restricting ATA management interface access
ip access-list extended ATA-MGMT-ACL
 permit tcp host 10.10.10.5 host 192.0.2.20 eq 443
 permit tcp host 10.10.10.5 host 192.0.2.20 eq 80
 deny   tcp any host 192.0.2.20 eq 443
 deny   tcp any host 192.0.2.20 eq 80
 permit ip any any