All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s web portal is vulnerable to accepting malicious firmware packages that could provide a backdoor to an attacker and provide privilege escalation to the device.
References
| Link | Resource |
|---|---|
| https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-01 | Patch Third Party Advisory US Government Resource |
Configurations
Configuration 1 (hide)
| AND |
|
History
16 Sep 2024, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s web portal is vulnerable to accepting malicious firmware packages that could provide a backdoor to an attacker and provide privilege escalation to the device. |
01 Feb 2024, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:h:etictelecom:ras-ec-220-lw:-:*:*:*:*:*:*:* cpe:2.3:h:etictelecom:ras-c-100-lw:-:*:*:*:*:*:*:* cpe:2.3:h:etictelecom:ras-ec-400-lw:-:*:*:*:*:*:*:* cpe:2.3:h:etictelecom:ras-e-100:-:*:*:*:*:*:*:* cpe:2.3:h:etictelecom:ras-ew-100:-:*:*:*:*:*:*:* cpe:2.3:h:etictelecom:ras-ew-400:-:*:*:*:*:*:*:* cpe:2.3:o:etictelecom:remote_access_server_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:etictelecom:ras-ew-220:-:*:*:*:*:*:*:* cpe:2.3:h:etictelecom:ras-ecw-400-lw:-:*:*:*:*:*:*:* cpe:2.3:h:etictelecom:ras-ecw-220-lw:-:*:*:*:*:*:*:* cpe:2.3:h:etictelecom:ras-e-400:-:*:*:*:*:*:*:* cpe:2.3:h:etictelecom:rfm-e:-:*:*:*:*:*:*:* cpe:2.3:h:etictelecom:ras-e-220:-:*:*:*:*:*:*:* cpe:2.3:h:etictelecom:ras-ec-480-lw:-:*:*:*:*:*:*:* |
|
| References | (MISC) https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-01 - Patch, Third Party Advisory, US Government Resource | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 10.0 |
| Summary | All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s web portal is vulnerable to accepting malicious firmware packages that could provide a backdoor to an attacker and provide privilege escalation to the device. |
10 Nov 2022, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-11-10 22:15
Updated : 2024-09-16 23:15
NVD link : CVE-2022-3703
Mitre link : CVE-2022-3703
CVE.ORG link : CVE-2022-3703
JSON object : View
Products Affected
etictelecom
- ras-ec-480-lw
- ras-ec-400-lw
- ras-c-100-lw
- ras-ecw-220-lw
- ras-ew-220
- ras-ecw-400-lw
- ras-e-220
- ras-ew-400
- ras-ec-220-lw
- remote_access_server_firmware
- ras-e-400
- ras-e-100
- rfm-e
- ras-ew-100
CWE
CWE-345
Insufficient Verification of Data Authenticity