CVE-2022-40981
ETIC Telecom Remote Access Server Unrestricted Upload of File with Dangerous Type
- Published
- Updated
- Reserved
- Assigned by
- icscert
Description
All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior is vulnerable to malicious file upload. An attacker could take advantage of this to store malicious files on the server, which could override sensitive and useful existing files on the filesystem, fill the hard disk to full capacity, or compromise the affected device or computers with administrator level privileges connected to the affected device.
Timeline
ID reserved
By icscert
- 42 days later
· 42 days later
Published
- 23 months later
· 23 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| icscertCNA (assigner) | 3.1 | Medium5.9 | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L |
| NVDNVD · Modified | 3.1 | Critical10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.62% · top 50% of all CVEs (7 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.
Weakness
Affected products
ETIC Telecom · Remote Access Server (RAS)
- affected ≤ 4.5.0
What to do
Solution: ETIC Telecom recommends updating the firmware of the affected devices to the following versions: * ETIC Telecom RAS: version 4.7.0 or later https://www.etictelecom.com/en/softwares-download/ For the installed devices, ETIC Telecom recommends: * For all firmware versions 4.7.0 and above, only valid configuration files can be uploaded to the device. For versions prior to 4.7.0, to reduce the attack surface, we advise the user to verify in the router configuration that: (1) The administration web page is accessible only through the LAN side over HTTPS, and (2) The administration web page is protected with authentication.
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-40981)Record last updated .