China’s Salt Typhoon Spies Are Still Hacking Telecoms—Now by Exploiting Cisco Routers

Despite high-profile attention and even US sanctions, the group hasn’t stopped or even slowed its operation, including the breach of two more US telecoms...

CVE-2022-22292

Unprotected dynamic receiver in Telecom prior to SMR Feb-2022 Release 1 allows untrusted applications to launch arbitrary activity...

CVE-2024-26153

All versions of ETIC Telecom Remote Access Server RAS prior to 4.9.19 are vulnerable to cross-site request forgery CSRF. An external attacker with no access to the device can force the end user into submitting a "setconf" method request, not requiring any CSRF token, which can lead into denial of...

Beware: Fake CAPTCHA Campaign Spreads Lumma Stealer in Multi-Industry Attacks

Cybersecurity researchers are calling attention to a new malware campaign that leverages fake CAPTCHA verification checks to deliver the infamous Lumma information stealer. "The campaign is global, with Netskope Threat Labs tracking victims targeted in Argentina, Colombia, the United States, the...

CVE-2024-26155

All versions of ETIC Telecom Remote Access Server RAS prior to 4.5.0 expose clear text credentials in the web portal. An attacker can access the ETIC RAS web portal and view the HTML code, which is configured to be hidden, thus allowing a connection to the ETIC RAS ssh server, which could enable ...

CVE-2024-26156

All versions of ETIC Telecom Remote Access Server RAS prior to 4.5.0 are vulnerable to reflected cross site scripting XSS attacks in the method parameter. The ETIC RAS web server uses dynamic pages that gets their input from the client side and reflects the input in its response to the client...

CVE-2024-26154

All versions of ETIC Telecom Remote Access Server RAS prior to 4.5.0 are vulnerable to reflected cross site scripting in the appliance site name. The ETIC RAS web server saves the site name and then presents it to the administrators in a few different pages...

CVE-2024-26155

All versions of ETIC Telecom Remote Access Server RAS prior to 4.5.0 expose clear text credentials in the web portal. An attacker can access the ETIC RAS web portal and view the HTML code, which is configured to be hidden, thus allowing a connection to the ETIC RAS ssh server, which could enable ...

CVE-2024-26157

All versions of ETIC Telecom Remote Access Server RAS prior to 4.5.0 are vulnerable to reflected cross site scripting XSS attacks in get view method under view parameter. The ETIC RAS web server uses dynamic pages that get their input from the client side and reflect the input in their response t...

CVE-2024-26157

All versions of ETIC Telecom Remote Access Server RAS prior to 4.5.0 are vulnerable to reflected cross site scripting XSS attacks in get view method under view parameter. The ETIC RAS web server uses dynamic pages that get their input from the client side and reflect the input in their response t...

CVE-2024-26156

All versions of ETIC Telecom Remote Access Server RAS prior to 4.5.0 are vulnerable to reflected cross site scripting XSS attacks in the method parameter. The ETIC RAS web server uses dynamic pages that gets their input from the client side and reflects the input in its response to the client...

CVE-2024-26153

All versions of ETIC Telecom Remote Access Server RAS prior to 4.9.19 are vulnerable to cross-site request forgery CSRF. An external attacker with no access to the device can force the end user into submitting a "setconf" method request, not requiring any CSRF token, which can lead into denial of...

CVE-2024-26153

All versions of ETIC Telecom Remote Access Server RAS prior to 4.9.19 are vulnerable to cross-site request forgery CSRF. An external attacker with no access to the device can force the end user into submitting a "setconf" method request, not requiring any CSRF token, which can lead into denial of...

CVE-2024-26153 ETIC Telecom Remote Access Server (RAS) Cross-Site Request Forgery

All versions of ETIC Telecom Remote Access Server RAS prior to 4.9.19 are vulnerable to cross-site request forgery CSRF. An external attacker with no access to the device can force the end user into submitting a "setconf" method request, not requiring any CSRF token, which can lead into denial of...

CVE-2024-26153

CVE-2024-26153 affects ETIC Telecom Remote Access Server (RAS) versions prior to 4.9.19. The issue is a CSRF flaw in the web portal that allows an external attacker with no device access to coerce an end user into submitting a setconf request without a CSRF token, potentially causing device denia...

CVE-2024-26153 ETIC Telecom Remote Access Server (RAS) Cross-Site Request Forgery

All versions of ETIC Telecom Remote Access Server RAS prior to 4.9.19 are vulnerable to cross-site request forgery CSRF. An external attacker with no access to the device can force the end user into submitting a "setconf" method request, not requiring any CSRF token, which can lead into denial of...

CVE-2024-26155 ETIC Telecom Remote Access Server (RAS) Cleartext Transmission of Sensitive Information

All versions of ETIC Telecom Remote Access Server RAS prior to 4.5.0 expose clear text credentials in the web portal. An attacker can access the ETIC RAS web portal and view the HTML code, which is configured to be hidden, thus allowing a connection to the ETIC RAS ssh server, which could enable ...

CVE-2024-26155 ETIC Telecom Remote Access Server (RAS) Cleartext Transmission of Sensitive Information

All versions of ETIC Telecom Remote Access Server RAS prior to 4.5.0 expose clear text credentials in the web portal. An attacker can access the ETIC RAS web portal and view the HTML code, which is configured to be hidden, thus allowing a connection to the ETIC RAS ssh server, which could enable ...

CVE-2024-26155

CVE-2024-26155 affects ETIC Telecom Remote Access Server (RAS) prior to version 4.5.0. The vulnerability exposes cleartext credentials via the RAS web portal (HTML that is normally hidden), enabling an attacker with network access to connect to the RAS SSH server and perform actions on the device...

CVE-2024-26154 ETIC Telecom Remote Access Server (RAS) Cross-site Scripting

All versions of ETIC Telecom Remote Access Server RAS prior to 4.5.0 are vulnerable to reflected cross site scripting in the appliance site name. The ETIC RAS web server saves the site name and then presents it to the administrators in a few different pages...