CVE-2024-26156

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting (XSS) attacks in the method parameter. The ETIC RAS web server uses dynamic pages that gets their input from the client side and reflects the input in its response to the client.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 17, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-261576.1All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting (XSS) attacks in ge CVE-2024-261587.8Microsoft Install Service Elevation of Privilege Vulnerability CVE-2024-261598.8Microsoft ODBC Driver Remote Code Execution Vulnerability CVE-2024-26162.7To harden ICU against exploitation, the behavior for out-of-memory conditions was changed to crash instead of attempt to continue. This vuln CVE-2024-261605.5Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability CVE-2024-261618.8Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability CVE-2024-261628.8Microsoft ODBC Driver Remote Code Execution Vulnerability CVE-2024-261634.7Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability CVE-2024-261648.8Microsoft Django Backend for SQL Server Remote Code Execution Vulnerability CVE-2024-261658.8Visual Studio Code Elevation of Privilege Vulnerability CVE-2024-261668.8Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability CVE-2024-261674.3Microsoft Edge for Android Spoofing Vulnerability