ETIC Telecom RAS Multiple Vulnerabilities Advisory (Path Traversal, XSS, CSRF, Unrestricted Upload)

Key Information Vulnerability Overview CVSS: 6.3 Threat Level: Remotely exploitable / Low attack complexity Vendor: ETIC Telecom Device: Remote Access Server (RAS) Vulnerability Types: Insufficient data authenticity verification, Path traversal, Unrestricted upload of dangerous file types, Cross-site scripting (XSS), Cross-site request forgery (CSRF), Sensitive information transmitted in plaintext Risk Assessment Successful exploitation of these vulnerabilities could allow attackers to obtain sensitive information and compromise vulnerable devices and other connected machines. Technical Details Affected Products The following versions of ETIC Telecom Remote Access Server (RAS) are affected: All versions prior to 4.5.0 (CVE-2022-3703, CVE-2022-41607, CVE-2022-40981, CVE-2024-26155, CVE-2024-26157, CVE-2024-26154, CVE-2024-26153, and CVE-2024-26153) Vulnerability Details Insufficient Data Authenticity Verification (CVE-2022-3703) All versions 4.5.0 and earlier are vulnerable to this issue. Path Traversal (CVE-2022-41607) All versions 4.5.0 and earlier are vulnerable to this issue. Unrestricted Upload of Dangerous File Types (CVE-2022-40981) All versions 4.5.0 and earlier are vulnerable to this issue. Cross-Site Scripting (XSS) (CVE-2024-26156) All versions 4.5.0 and earlier are vulnerable to this issue. Cross-Site Request Forgery (CSRF) (CVE-2024-26153) All versions prior to 4.9.19 are vulnerable to this issue. Background Critical Infrastructure Sectors: Communications, Information Technology, Energy Deployment Countries/Regions: Global Company Headquarters Location: France Researchers Haviv Vaizman, Hay Mizrachi, Alik Koldobsky, Ofir Manzur, and Nikolay Sokolik, representing OTORIO, reported these vulnerabilities to CISA. Mitigation Measures For installed devices, ETIC Telecom recommends measures such as firmware upgrades, verifying firmware sources, and configuration file validation.

Goal Reached Thanks to every supporter — we hit 100%!

ETIC Telecom RAS Multiple Vulnerabilities Advisory (Path Traversal, XSS, CSRF, Unrestricted Upload)