CVE-2024-26154

ETIC Telecom Remote Access Server (RAS) Cross-site Scripting

State: Published
Severity: 4.8 Medium
Published: Jan 17, 2025
Updated: Jan 21, 2025
Reserved: Feb 14, 2024

Description

All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting in the appliance site name. The ETIC RAS web server saves the site name and then presents it to the administrators in a few different pages.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N	icscert
3.1	4.8 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N	icscert

Weaknesses

CWE-79 Cross-site Scripting

Affected Products

Product	Versions
Remote Access Server (RAS)ETIC Telecom	before 4.5.0Affected

References

https://www.cisa.gov/news-events/ics-advisories/icsa-22-307-01

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.