CVE-2024-20421
📋 TL;DR
An unauthenticated remote attacker can perform CSRF attacks against Cisco ATA 190 Series Analog Telephone Adapter web management interfaces. This allows arbitrary actions with the privileges of a logged-in user who clicks a malicious link. Organizations using affected Cisco ATA 190 devices are vulnerable.
💻 Affected Systems
- Cisco ATA 190 Series Analog Telephone Adapter
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover: attacker could reconfigure device settings, disable services, change passwords, or disrupt telephony services.
Likely Case
Unauthorized configuration changes leading to service disruption or security policy bypass.
If Mitigated
Limited impact if devices are on isolated networks with strict access controls and user awareness training.
🎯 Exploit Status
Exploitation requires social engineering to get user to click malicious link while authenticated to device management interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.0(1)SR1 and later
Vendor Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy
Restart Required: Yes
Instructions:
1. Download firmware 12.0(1)SR1 or later from Cisco. 2. Log into device web interface. 3. Navigate to Administration > Software Upgrade. 4. Upload and install new firmware. 5. Reboot device.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to device management interfaces to trusted networks only.
Use HTTPS Only
allConfigure device to use HTTPS exclusively for management interface.
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach device management interfaces.
- Educate users about CSRF risks and implement browser security extensions that block CSRF attempts.
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface: System Information > Software Version. If version is earlier than 12.0(1)SR1, device is vulnerable.Check Version:
No CLI command; check via web interface System Information page.Verify Fix Applied:
After patching, verify firmware version shows 12.0(1)SR1 or later in System Information.📡 Detection & Monitoring
Log Indicators:
- Multiple configuration changes from unexpected IP addresses
- Authentication failures followed by configuration changes
Network Indicators:
- HTTP POST requests to device management interface from unexpected sources
- Cross-origin requests to device management endpoints
SIEM Query:
source_ip NOT IN (trusted_admin_ips) AND destination_port=80 AND http_method=POST AND uri CONTAINS "/cgi-bin/"