CVE-2024-20458: Cisco ATA 191 Auth Bypass Vulnerability

CVE-2024-20458 Overview

CVE-2024-20458 is a missing authentication vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware. An unauthenticated, remote attacker can browse to specific HTTP endpoints to view or delete device configuration, or replace the firmware on an affected device. The flaw is tracked under [CWE-78] in the NVD record but functions as a broken access control issue on administrative endpoints. Cisco published the advisory on October 16, 2024, covering the ATA 191 (on-premises and multiplatform) and ATA 192 (multiplatform) models.

Critical Impact
Unauthenticated attackers reachable to the device management interface can wipe configuration, exfiltrate sensitive call routing data, or push attacker-controlled firmware to the adapter.

Affected Products

Cisco ATA 191 Analog Telephone Adapter (on-premises firmware)
Cisco ATA 191 Analog Telephone Adapter (multiplatform firmware)
Cisco ATA 192 Analog Telephone Adapter (multiplatform firmware)

Discovery Timeline

2024-10-16 - Cisco publishes security advisory cisco-sa-ata19x-multi-RDTEqRsy
2024-10-16 - CVE-2024-20458 published to NVD
2024-10-22 - Last updated in NVD database

Technical Details for CVE-2024-20458

Vulnerability Analysis

The Cisco ATA 190 Series web management interface exposes several HTTP endpoints that perform privileged administrative actions. These endpoints fail to enforce authentication before executing requested operations. A remote attacker who can reach the device over the network can request these URLs directly and receive the same response a logged-in administrator would.

The impact spans three administrative capabilities. First, the attacker can read configuration data containing SIP credentials, call routing rules, and provisioning server addresses. Second, the attacker can delete the running configuration, returning the device to an unprovisioned state and disrupting voice service. Third, and most consequentially, the attacker can trigger a firmware change, allowing replacement of the legitimate image with an attacker-supplied one.

Firmware replacement converts a configuration disclosure issue into a persistent foothold on the telephony edge. A modified image can intercept call audio, relay SIP traffic, or pivot into the voice VLAN. The vulnerability is listed under the [CWE-78] OS Command Injection weakness in the NVD entry, but the advisory describes the root cause as missing authentication on management endpoints.

Root Cause

The root cause is absent authentication checks on specific HTTP endpoints in the embedded web server. The endpoints process configuration read, configuration delete, and firmware update requests without validating session state or credentials.

Attack Vector

Exploitation requires only network reachability to the ATA management interface over HTTP. No credentials, user interaction, or prior access are required. An attacker browses to the vulnerable URL, and the device performs the requested administrative action. Verified proof-of-concept code is not publicly indexed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog as of publication.

Refer to the Cisco Security Advisory for the authoritative list of vulnerable endpoints and fixed firmware versions.

Detection Methods for CVE-2024-20458

Indicators of Compromise

Unexpected firmware version strings reported by ATA 191 or ATA 192 devices that do not match the inventory baseline.
Configuration reset events or sudden loss of SIP registration on ATA endpoints without a corresponding administrator action ticket.
HTTP requests to ATA management URLs originating from source addresses outside the voice management subnet.

Detection Strategies

Compare cryptographic hashes or version banners of deployed ATA firmware against the Cisco-published fixed releases on a recurring schedule.
Inspect web server access logs, if exported via syslog, for unauthenticated GET requests to configuration or firmware endpoints.
Alert on TFTP or HTTP firmware download traffic from ATA devices to destinations not on the approved provisioning server list.

Monitoring Recommendations

Forward ATA syslog to a centralized log platform and create alerts for firmware upgrade, configuration cleared, and reboot events.
Capture NetFlow or IPFIX from the voice VLAN gateway and baseline normal management traffic patterns for each ATA device.
Track device-to-management-station relationships and flag any new IP attempting to contact the ATA web interface.

How to Mitigate CVE-2024-20458

Immediate Actions Required

Identify all Cisco ATA 191 and ATA 192 units in the environment along with their current firmware versions.
Restrict TCP access to the ATA web management interface using ACLs on the upstream switch or router so only the provisioning server and authorized administrator workstations can connect.
Place ATA devices in a dedicated voice management VLAN that is not routable from user, guest, or internet-facing networks.
Apply the fixed firmware released by Cisco as soon as a maintenance window is available.

Patch Information

Cisco has released fixed firmware for the affected ATA 191 and ATA 192 product lines. Consult the Cisco Security Advisory for the specific fixed versions corresponding to each hardware variant and load type. There are no documented workarounds that fully remediate the vulnerability other than installing fixed software.

Workarounds

Disable the web-based management interface where device administration can be performed through the provisioning server instead.
Apply infrastructure ACLs limiting HTTP access to the ATA management IP to a small allowlist of administrator hosts.
Segment the voice network so that ATA devices are not reachable from corporate user subnets or wireless guest networks.

bash

# Example IOS ACL restricting access to ATA management interface
ip access-list extended ATA-MGMT-RESTRICT
 permit tcp host 10.10.20.5 host 10.10.30.10 eq 80
 permit tcp host 10.10.20.5 host 10.10.30.10 eq 443
 deny   tcp any host 10.10.30.10 eq 80 log
 deny   tcp any host 10.10.30.10 eq 443 log
 permit ip any any
!
interface Vlan30
 ip access-group ATA-MGMT-RESTRICT in