{"id":"CVE-2024-26154","state":"PUBLISHED","title":"ETIC Telecom Remote Access Server (RAS) Cross-site Scripting","description":"All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 \nare vulnerable to reflected cross site scripting in the appliance site \nname. The ETIC RAS web server saves the site name and then presents it \nto the administrators in a few different pages.","publishedAt":"2025-01-17T16:17:10.899Z","updatedAt":"2025-01-21T14:56:13.407Z","severity":{"score":4.8,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","source":"icscert"},"assigner":"icscert","products":["ETIC Telecom Remote Access Server (RAS)"],"affected":[{"vendor":"ETIC Telecom","product":"Remote Access Server (RAS)","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.5.0","versionType":"custom"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-22-307-01"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:07:10.607Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/26xxx/CVE-2024-26154.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-26154","state":"PUBLISHED","datePublished":"2025-01-17T16:17:10.899Z","dateUpdated":"2025-01-21T14:56:13.407Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2024-02-14T22:03:32.380Z"},"containers":{"cna":{"title":"ETIC Telecom Remote Access Server (RAS) Cross-site Scripting","descriptions":[{"lang":"en","value":"All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 \nare vulnerable to reflected cross site scripting in the appliance site \nname. The ETIC RAS web server saves the site name and then presents it \nto the administrators in a few different pages."}],"affected":[{"vendor":"ETIC Telecom","product":"Remote Access Server (RAS)","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.5.0","versionType":"custom"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-22-307-01"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":4.8,"baseSeverity":"MEDIUM","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Cross-site Scripting","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2025-01-17T16:17:10.899Z"},"credits":[{"lang":"en","type":"finder","value":"Haviv Vaizman, Hay Mizrachi, Alik Koldobsky, Ofir Manzur, and Nikolay Sokolik of OTORIO reported these vulnerabilities to CISA."}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"For all firmware versions <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.etictelecom.com/en/softwares-download/\">4.5.0</a> and above, this issue is fixed."}],"value":"For all firmware versions  4.5.0 https://www.etictelecom.com/en/softwares-download/  and above, this issue is fixed."}],"source":{"advisory":"ICSA-22-307-01","discovery":"EXTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"For versions prior to 4.5.0, to reduce the attack surface, ETIC Telecom \nadvise the user to verify in the router configuration that: (1) The \nadministration web page is accessible only through the LAN side over \nHTTPS, and (2) The administration web page is protected with \nauthentication.\n\n<br>"}],"value":"For versions prior to 4.5.0, to reduce the attack surface, ETIC Telecom \nadvise the user to verify in the router configuration that: (1) The \nadministration web page is accessible only through the LAN side over \nHTTPS, and (2) The administration web page is protected with \nauthentication."}],"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-01-21T14:55:51.814303Z","id":"CVE-2024-26154","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-01-21T14:56:13.407Z"}}]}}}