CVE-2024-26156

ETIC Telecom Remote Access Server (RAS) Cross-site Scripting

State: Published
Severity: 4.8 Medium
Published: Jan 17, 2025
Updated: Jan 21, 2025
Reserved: Feb 14, 2024

Description

All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting (XSS) attacks in the method parameter. The ETIC RAS web server uses dynamic pages that gets their input from the client side and reflects the input in its response to the client.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N	icscert
3.1	4.8 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N	icscert

Weaknesses

CWE-79 Cross-site Scripting

Affected Products

Product	Versions
Remote Access Server (RAS)ETIC Telecom	before 4.5.0Affected

References

https://www.cisa.gov/news-events/ics-advisories/icsa-22-307-01

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.