-
Notifications
You must be signed in to change notification settings - Fork 210
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- 1 new CVEs: CVE-2024-26153 - 1 updated CVEs: CVE-2024-12578
- Loading branch information
cvelistV5 Github Action
committed
Jan 17, 2025
1 parent
cb1520b
commit aae41ce
Showing
4 changed files
with
190 additions
and
183 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,152 @@ | ||
| { | ||
| "dataType": "CVE_RECORD", | ||
| "dataVersion": "5.1", | ||
| "cveMetadata": { | ||
| "cveId": "CVE-2024-26153", | ||
| "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", | ||
| "state": "PUBLISHED", | ||
| "assignerShortName": "icscert", | ||
| "dateReserved": "2024-02-14T22:03:32.379Z", | ||
| "datePublished": "2025-01-17T16:23:10.357Z", | ||
| "dateUpdated": "2025-01-17T16:23:10.357Z" | ||
| }, | ||
| "containers": { | ||
| "cna": { | ||
| "affected": [ | ||
| { | ||
| "defaultStatus": "unaffected", | ||
| "product": "Remote Access Server (RAS)", | ||
| "vendor": "ETIC Telecom", | ||
| "versions": [ | ||
| { | ||
| "lessThan": "4.9.19", | ||
| "status": "affected", | ||
| "version": "0", | ||
| "versionType": "custom" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "credits": [ | ||
| { | ||
| "lang": "en", | ||
| "type": "finder", | ||
| "value": "Haviv Vaizman, Hay Mizrachi, Alik Koldobsky, Ofir Manzur, and Nikolay Sokolik of OTORIO reported these vulnerabilities to CISA." | ||
| } | ||
| ], | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "supportingMedia": [ | ||
| { | ||
| "base64": false, | ||
| "type": "text/html", | ||
| "value": "All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.9.19 \nare vulnerable to cross-site request forgery (CSRF). An external \nattacker with no access to the device can force the end user into \nsubmitting a \"setconf\" method request, not requiring any CSRF token, \nwhich can lead into denial of service on the device." | ||
| } | ||
| ], | ||
| "value": "All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.9.19 \nare vulnerable to cross-site request forgery (CSRF). An external \nattacker with no access to the device can force the end user into \nsubmitting a \"setconf\" method request, not requiring any CSRF token, \nwhich can lead into denial of service on the device." | ||
| } | ||
| ], | ||
| "metrics": [ | ||
| { | ||
| "cvssV3_1": { | ||
| "attackComplexity": "LOW", | ||
| "attackVector": "NETWORK", | ||
| "availabilityImpact": "HIGH", | ||
| "baseScore": 7.4, | ||
| "baseSeverity": "HIGH", | ||
| "confidentialityImpact": "NONE", | ||
| "integrityImpact": "NONE", | ||
| "privilegesRequired": "NONE", | ||
| "scope": "CHANGED", | ||
| "userInteraction": "REQUIRED", | ||
| "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H", | ||
| "version": "3.1" | ||
| }, | ||
| "format": "CVSS", | ||
| "scenarios": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "GENERAL" | ||
| } | ||
| ] | ||
| }, | ||
| { | ||
| "cvssV4_0": { | ||
| "Automatable": "NOT_DEFINED", | ||
| "Recovery": "NOT_DEFINED", | ||
| "Safety": "NOT_DEFINED", | ||
| "attackComplexity": "LOW", | ||
| "attackRequirements": "NONE", | ||
| "attackVector": "NETWORK", | ||
| "baseScore": 6.3, | ||
| "baseSeverity": "MEDIUM", | ||
| "privilegesRequired": "NONE", | ||
| "providerUrgency": "NOT_DEFINED", | ||
| "subAvailabilityImpact": "HIGH", | ||
| "subConfidentialityImpact": "NONE", | ||
| "subIntegrityImpact": "NONE", | ||
| "userInteraction": "PASSIVE", | ||
| "valueDensity": "NOT_DEFINED", | ||
| "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H", | ||
| "version": "4.0", | ||
| "vulnAvailabilityImpact": "NONE", | ||
| "vulnConfidentialityImpact": "NONE", | ||
| "vulnIntegrityImpact": "NONE", | ||
| "vulnerabilityResponseEffort": "NOT_DEFINED" | ||
| }, | ||
| "format": "CVSS", | ||
| "scenarios": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "GENERAL" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "problemTypes": [ | ||
| { | ||
| "descriptions": [ | ||
| { | ||
| "cweId": "CWE-352", | ||
| "description": "CWE-352 Cross-Site Request Forgery (CSRF)", | ||
| "lang": "en", | ||
| "type": "CWE" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "providerMetadata": { | ||
| "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", | ||
| "shortName": "icscert", | ||
| "dateUpdated": "2025-01-17T16:23:10.357Z" | ||
| }, | ||
| "references": [ | ||
| { | ||
| "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-307-01" | ||
| } | ||
| ], | ||
| "solutions": [ | ||
| { | ||
| "lang": "en", | ||
| "supportingMedia": [ | ||
| { | ||
| "base64": false, | ||
| "type": "text/html", | ||
| "value": "ETIC Telecom recommends updating the affected device firmware to version <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.etictelecom.com/en/softwares-download/\">4.9.19</a> or later." | ||
| } | ||
| ], | ||
| "value": "ETIC Telecom recommends updating the affected device firmware to version 4.9.19 https://www.etictelecom.com/en/softwares-download/ or later." | ||
| } | ||
| ], | ||
| "source": { | ||
| "advisory": "ICSA-22-307-01", | ||
| "discovery": "EXTERNAL" | ||
| }, | ||
| "title": "ETIC Telecom Remote Access Server (RAS) Cross-Site Request Forgery", | ||
| "x_generator": { | ||
| "engine": "Vulnogram 0.2.0" | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.