CVE-2022-41607

CVE-2022-41607 affects ETIC Telecom Remote Access Server (RAS). All versions up to 4.5.0 are vulnerable to directory traversal via the API and related interfaces, potentially enabling an attacker to read sensitive files (e.g., SSH keys, passwords, scripts) and compromise the device. Public docume...

CVE-2022-3703

CVE-2022-3703 affects ETIC Telecom Remote Access Server (RAS) web portal. All versions ≤ 4.5.0 are vulnerable to accepting malicious firmware packages, enabling a backdoor and device privilege escalation. Root cause: the web portal cannot verify firmware authenticity, per multiple sources. Impact...

CVE-2022-40981

The CVE-2022-40981 issue affects ETIC Telecom Remote Access Server (RAS) prior to 4.7.0 (versions 4.5.0 and earlier). Technical details from connected sources describe three vulnerabilities in RAS: CVE-2022-3703 (insufficient verification of data authenticity) allowing rogue firmware backdoors wi...

CVE-2023-3453

CVE-2023-3453 affects ETIC Telecom RAS (Remote Access Server) versions 4.7.0 and earlier. The vulnerability stems from insecure default initialization where the web management portal authentication is disabled by default, allowing an attacker with adjacent network access to reconfigure the device...

CVE-2024-26153

CVE-2024-26153 affects ETIC Telecom Remote Access Server (RAS) versions prior to 4.9.19. The issue is a CSRF flaw in the web portal that allows an external attacker with no device access to coerce an end user into submitting a setconf request without a CSRF token, potentially causing device denia...

CVE-2024-26155

CVE-2024-26155 affects ETIC Telecom Remote Access Server (RAS) prior to version 4.5.0. The vulnerability exposes cleartext credentials via the RAS web portal (HTML that is normally hidden), enabling an attacker with network access to connect to the RAS SSH server and perform actions on the device...

CVE-2024-26156

CVE-2024-26156 affects all versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0. The vulnerability is a reflected cross-site scripting (XSS) in the HTTP method parameter, caused by dynamic pages that reflect client-provided input. Public details consistently describe the impact as a...

CVE-2024-26157

ETIC Telecom Remote Access Server (RAS) is affected. All versions before 4.5.0 are vulnerable to reflected XSS in the get view method (view parameter). The issue stems from reflecting client-provided input in responses. Impact is cross-site scripting risk; exploitation details are not provided in...

CVE-2024-26154

ETIC Telecom Remote Access Server (RAS) vulnerability CVE-2024-26154 affects all RAS versions prior to 4.5.0. The issue is reflected cross-site scripting in the appliance site name saved by the ETIC RAS web server and displayed to administrators on multiple pages. Reported impact is web-based XSS...