Vulnerability · Published Nov 10, 2022 · Assigned by icscert
CVE-2022-41607ETIC Telecom Remote Access Server Path Traversal
Medium 6.2
In plain English
A medium-severity path traversal in Remote Access Server (RAS) from ETIC Telecom. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).
Severity (CVSS 3.1)6.2Medium
Exploit odds (30 days)1.0%top 37.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s application programmable interface (API) is vulnerable to directory traversal through several different methods. This could allow an attacker to read sensitive files from the server, including SSH private keys, passwords, scripts, python objects, database files, and more.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ETIC Telecom | Remote Access Server (RAS) | 0 – through 4.5.0 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N