PT-2022-23763 · Etic Telecom · Etic Telecom Remote Access Server

Alik Koldobsky + 4 · Published 2022-11-10 · Updated 2024-09-16 · CVE-2022-3703

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ETIC Telecom Remote Access Server (RAS) versions 4.5.0 and prior

Description The web portal of the affected software is vulnerable to accepting malicious firmware packages, which could provide a backdoor to an attacker and allow privilege escalation to the device.

Recommendations For versions 4.5.0 and prior, update to a version that is not affected by this issue, as the current version is vulnerable to malicious firmware packages. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2022-3703

Affected Products

Etic Telecom Remote Access Server

References · 5

• https://osv.dev/vulnerability/CVE-2022-3703 · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-22-307-01 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-3703 · Security Note
• https://t.me/true_secator/4051 · Telegram Post
• https://t.me/cvenotify/69603 · Telegram Post