CVE-2024-26153

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.9.19 are vulnerable to cross-site request forgery (CSRF). An external attacker with no access to the device can force the end user into submitting a "setconf" method request, not requiring any CSRF token, which can lead into denial of service on the device.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Jan 17, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-261546.1All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting in the appliance si CVE-2024-261558.6All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 expose clear text credentials in the web portal. An attacker can acc CVE-2024-261566.1All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting (XSS) attacks in th CVE-2024-261576.1All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting (XSS) attacks in ge CVE-2024-261587.8Microsoft Install Service Elevation of Privilege Vulnerability CVE-2024-261598.8Microsoft ODBC Driver Remote Code Execution Vulnerability CVE-2024-26162.7To harden ICU against exploitation, the behavior for out-of-memory conditions was changed to crash instead of attempt to continue. This vuln CVE-2024-261605.5Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability CVE-2024-261618.8Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability CVE-2024-261628.8Microsoft ODBC Driver Remote Code Execution Vulnerability CVE-2024-261634.7Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability CVE-2024-261648.8Microsoft Django Backend for SQL Server Remote Code Execution Vulnerability