Description
All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.9.19
are vulnerable to cross-site request forgery (CSRF). An external
attacker with no access to the device can force the end user into
submitting a "setconf" method request, not requiring any CSRF token,
which can lead into denial of service on the device.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ETIC Telecom | Remote Access Server (RAS) | < 4.9.19 | 4.9.19 |
Advisories 1
- ICSA-22-307-01 ETIC Telecom Remote Access Server (RAS) (Update B) CISA ICS & IT advisories · Dec 3, 2024