CVE-2022-41607

All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s application programmable interface (API) is vulnerable to directory traversal through several different methods. This could allow an attacker to read sensitive files from the server, including SSH private keys, passwords, scr...

CVE-2022-3703

All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s web portal is vulnerable to accepting malicious firmware packages that could provide a backdoor to an attacker and provide privilege escalation to the device.

CVE-2022-40981

All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior is vulnerable to malicious file upload. An attacker could take advantage of this to store malicious files on the server, which could override sensitive and useful existing files on the filesystem, fill the hard disk to full cap...

CVE-2023-3453

ETIC Telecom RAS versions 4.7.0 and prior the web management portal authentication disabled by default. This could allow an attacker with adjacent network access to alter the configuration of the device or cause a denial-of-service condition.

CVE-2024-26153

All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.9.19are vulnerable to cross-site request forgery (CSRF). An externalattacker with no access to the device can force the end user intosubmitting a "setconf" method request, not requiring any CSRF token,which can lead into denial of s...

CVE-2024-26156

All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0are vulnerable to reflected cross site scripting (XSS) attacks in themethod parameter. The ETIC RAS web server uses dynamic pages that getstheir input from the client side and reflects the input in its responseto the client.

CVE-2024-26155

All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0expose clear text credentials in the web portal. An attacker can accessthe ETIC RAS web portal and view the HTML code, which is configured tobe hidden, thus allowing a connection to the ETIC RAS ssh server, whichcould enable an a...

CVE-2024-26157

All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0are vulnerable to reflected cross site scripting (XSS) attacks in getview method under view parameter. The ETIC RAS web server uses dynamicpages that get their input from the client side and reflect the input intheir response to ...

CVE-2024-26154

All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0are vulnerable to reflected cross site scripting in the appliance sitename. The ETIC RAS web server saves the site name and then presents itto the administrators in a few different pages.