PT-2022-25982 · Etic Telecom · Etic Telecom Remote Access Server

Published 2022-11-10 · Updated 2024-09-16 · CVE-2022-41607

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ETIC Telecom Remote Access Server (RAS) versions 4.5.0 and prior

Description The application programmable interface (API) of the affected software is vulnerable to directory traversal through several different methods. This could allow an attacker to read sensitive files from the server, including SSH private keys, passwords, scripts, python objects, database files, and more.

Recommendations For versions 4.5.0 and prior, consider restricting access to the API to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the ability to read sensitive files from the server. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-41607

Affected Products

Etic Telecom Remote Access Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-41607 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-307-01 · Patch
• https://osv.dev/vulnerability/CVE-2022-41607 · Vendor Advisory
• https://t.me/cibsecurity/52908 · Telegram Post
• https://t.me/true_secator/4051 · Telegram Post