CVE-2024-26153

All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.9.19 are vulnerable to cross-site request forgery (CSRF). An external attacker with no access to the device can force the end user into submitting a "setconf" method request, not requiring any CSRF token, which can lead into denial of service on the device.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-22-307-01	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

cpe:2.3:o:etictelecom:remote_access_server_firmware:*:*:*:*:*:*:*:*

History

30 Jul 2025, 17:15

Type	Values Removed	Values Added
CPE		cpe:2.3:o:etictelecom:remote_access_server_firmware::::::::
Summary		(es) Todas las versiones de ETIC Telecom Remote Access Server (RAS) anteriores a la 4.9.19 son vulnerables a Cross-Site Request Forgery (CSRF). Un atacante externo sin acceso al dispositivo puede obligar al usuario final a enviar una solicitud de método ""setconf"", sin necesidad de ningún token CSRF, lo que puede provocar una denegación de servicio en el dispositivo.
First Time		Etictelecom remote Access Server Firmware Etictelecom
References	~~() https://www.cisa.gov/news-events/ics-advisories/icsa-22-307-01 -~~	() https://www.cisa.gov/news-events/ics-advisories/icsa-22-307-01 - Third Party Advisory, US Government Resource

17 Jan 2025, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-01-17 17:15

Updated : 2025-07-30 17:15

NVD link : CVE-2024-26153

Mitre link : CVE-2024-26153

CVE.ORG link : CVE-2024-26153

JSON object : View

Products Affected

etictelecom

remote_access_server_firmware

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2024-26153", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-01-17T17:15:10.927", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-307-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.9.19 \nare vulnerable to cross-site request forgery (CSRF). An external \nattacker with no access to the device can force the end user into \nsubmitting a \"setconf\" method request, not requiring any CSRF token, \nwhich can lead into denial of service on the device."}, {"lang": "es", "value": "Todas las versiones de ETIC Telecom Remote Access Server (RAS) anteriores a la 4.9.19\nson vulnerables a Cross-Site Request Forgery (CSRF). Un atacante externo sin acceso al dispositivo puede obligar al usuario final a enviar una solicitud de m\u00e9todo \"\"setconf\"\", sin necesidad de ning\u00fan token CSRF, lo que puede provocar una denegaci\u00f3n de servicio en el dispositivo. "}], "lastModified": "2025-07-30T17:15:26.473", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:etictelecom:remote_access_server_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "05FE5798-3A2B-4D3F-9F28-BAC9B8BB7721", "versionEndExcluding": "4.9.19"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}