CVE-2024-26153 ETIC Telecom Remote Access Server (RAS) Cross-Site Request Forgery
An attacker can force users to submit configuration requests, causing denial of service on ETIC Telecom Remote Access Server devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-26153?
CVE-2024-26153 is a medium-severity vulnerability in ETIC Telecom Remote Access Server (RAS), published on 17 Jan 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.9.19 are vulnerable to cross-site request forgery (CSRF). An external attacker with no access to the device can force the end user into submitting a "setconf" method request, not requiring any CSRF token, which can lead into denial of service on the device.
Weakness: CWE-352
Which versions are affected by CVE-2024-26153?
It affects 1 product.
Products include Etictelecom Remote Access Server Firmware.
How do I fix CVE-2024-26153?
No fix has been published for CVE-2024-26153 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-26153 being exploited?
There is no known exploitation of CVE-2024-26153 in the wild and no public exploit code.
Other vulnerabilities in ETIC Telecom Remote Access Server (RAS)
- CVE-2022-3703 ETIC Telecom Remote Access Server Insufficient Verification of Data Authenticity
- CVE-2023-3453 ETIC Telecom Insecure Default Initialization of Resource
- CVE-2022-41607 ETIC Telecom Remote Access Server Path Traversal
- CVE-2024-26155 ETIC Telecom Remote Access Server (RAS) Cleartext Transmission of Sensitive Information
- CVE-2022-40981 ETIC Telecom Remote Access Server Unrestricted Upload of File with Dangerous Type
Sources
Also known as GHSA-3863-q6pp-rrcg.