CVE-2022-41607
published 2022-11-10CVE-2022-41607: All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s application programmable interface (API) is vulnerable to directory traversal through…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.95%
56.9th percentile
All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s application programmable interface (API) is vulnerable to directory traversal through several different methods. This could allow an attacker to read sensitive files from the server, including SSH private keys, passwords, scripts, python objects, database files, and more.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| etic_telecom | remote_access_server | <= 4.5.0 | — |
| etictelecom | remote_access_server_firmware | <= 4.5.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
ETIC Telecom Remote Access Server (RAS) (Update B)
cisa_ics·2024-12-03·CVSS 7.6
[HIGH] ETIC Telecom Remote Access Server (RAS) (Update B)
ICS Advisory
##
ETIC Telecom Remote Access Server (RAS) (Update B)
Last RevisedDecember 03, 2024
Alert CodeICSA-22-307-01
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
## 1. EXECUTIVE SUMMARY
- CVSS v4 6.3
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: ETIC Telecom
- Equipment: Remote Access Server (RAS)
- Vulnerabilities: Insufficient Verification of Data Authenticity, Path Traversal, Unrestricted Upload of File with Dangerous Type, Cross-site Scripting, Cross-Site Request Forgery, Cleartext Transmission of Sensitive Information
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to obtain sensitive information and compromise the vulnerable device and o
GHSA
GHSA-9xjj-cx8r-x5m9: All versions of ETIC Telecom Remote Access Server (RAS) 4
ghsa_unreviewed·2023-07-06
CVE-2022-41607 [HIGH] CWE-22 GHSA-9xjj-cx8r-x5m9: All versions of ETIC Telecom Remote Access Server (RAS) 4
All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s application programmable interface (API) is vulnerable to directory traversal through several different methods. This could allow an attacker to read sensitive files from the server, including SSH private keys, passwords, scripts, python objects, database files, and more.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-11-10
Published