CVE-2024-26153 — ETIC Telecom Remote Access Server (RAS) Cross-Site Request Forgery

CVE-2024-26153

ETIC Telecom Remote Access Server (RAS) Cross-Site Request Forgery PUBLISHED

Description (CNA)

All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.9.19 are vulnerable to cross-site request forgery (CSRF). An external attacker with no access to the device can force the end user into submitting a "setconf" method request, not requiring any CSRF token, which can lead into denial of service on the device.

Affected (CNA)

Vendor / product	Versions
ETIC Telecom / Remote Access Server (RAS)	affected 0 before 4.9.19

CWE

CWE-352

References

https://www.cisa.gov/news-events/ics-advisories/icsa-22-307-01

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.