Remote Access Server (RAS) vulnerabilities
6 known vulnerabilities in Remote Access Server (RAS) from ETIC Telecom. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.6 High severity
Remote Access Server (RAS): Cleartext Transmission of Sensitive Information
All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 expose clear text credentials in the web portal. An attacker can access the ETIC RAS web portal and view the HTML code, which is configured to be hidden, thus allowing a connection to the E
- 7.4 High severity
Remote Access Server (RAS): Cross-Site Request Forgery
All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.9.19 are vulnerable to cross-site request forgery (CSRF). An external attacker with no access to the device can force the end user into submitting a "setconf" method request, not requiring any
- 8.1 High severity
Remote Access Server (RAS): Initialization of a Resource with an Insecure Default
ETIC Telecom RAS versions 4.7.0 and prior the web management portal authentication disabled by default. This could allow an attacker with adjacent network access to alter the configuration of the device or cause a denial-of-service condition.
- 7.5 High severity
Remote Access Server (RAS): Improper Limitation of a Pathname to a Restricted Directory
All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s application programmable interface (API) is vulnerable to directory traversal through several different methods. This could allow an attacker to read sensitive files from the server, inc
- 10.0 Critical severity
Remote Access Server (RAS): Unrestricted Upload of File with Dangerous Type
All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior is vulnerable to malicious file upload. An attacker could take advantage of this to store malicious files on the server, which could override sensitive and useful existing files on the fil
- 10.0 Critical severity
Remote Access Server (RAS): Insufficient Verification of Data Authenticity
All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s web portal is vulnerable to accepting malicious firmware packages that could provide a backdoor to an attacker and provide privilege escalation to the device.