CVE-2024-26155: ETIC Telecom Remote Access Server (RAS) Cleartext Transmission of Sensitive Information
First published: Fri Jan 17 2025(Updated: )
All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 expose clear text credentials in the web portal. An attacker can access the ETIC RAS web portal and view the HTML code, which is configured to be hidden, thus allowing a connection to the ETIC RAS ssh server, which could enable an attacker to perform actions on the device.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ETIC Telecom RAS | <4.5.0 | 4.5.0 |
| ETIC Telecom RAS | <4.9.19 | 4.9.19 |
Remedy
For all firmware versions 4.5.0 https://www.etictelecom.com/en/softwares-download/ and above, this issue is fixed.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-26155?
CVE-2024-26155 is classified as a high severity vulnerability due to the exposure of clear text credentials.
How do I fix CVE-2024-26155?
To fix CVE-2024-26155, upgrade the ETIC Telecom Remote Access Server to version 4.5.0 or later.
What types of credentials are exposed in CVE-2024-26155?
CVE-2024-26155 exposes clear text credentials within the web portal of the ETIC Telecom Remote Access Server.
Which versions of ETIC Telecom RAS are affected by CVE-2024-26155?
All versions of ETIC Telecom Remote Access Server prior to 4.5.0 are affected by CVE-2024-26155.
Can attackers exploit CVE-2024-26155 remotely?
Yes, attackers can exploit CVE-2024-26155 remotely by accessing the misconfigured web portal to retrieve sensitive credentials.
- agent/weakness
- agent/title
- agent/remedy
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/event
- agent/source
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- vendor/: etic telecom
- canonical/etic telecom ras