CVE-2022-41607
ETIC Telecom Remote Access Server Path Traversal
- Published
- Updated
- Reserved
- Assigned by
- icscert
Description
All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s application programmable interface (API) is vulnerable to directory traversal through several different methods. This could allow an attacker to read sensitive files from the server, including SSH private keys, passwords, scripts, python objects, database files, and more.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| icscertCNA (assigner) | 3.1 | Medium6.2 | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N |
| NVDNVD · Modified | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 1.1% · top 34% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.2.
Weakness
Affected products
ETIC Telecom · Remote Access Server (RAS)
- affected ≤ 4.5.0
What to do
Solution: ETIC Telecom recommends updating the firmware of the affected devices to the following versions: * ETIC Telecom RAS: version 4.7.0 or later https://www.etictelecom.com/en/softwares-download/ For the installed devices, ETIC Telecom recommends: * This issue has been fixed in version 4.7.0. For versions prior to 4.7.0, to reduce the attack surface, we advise the user to verify in the router configuration that: (1) The administration web page is accessible only through the LAN side over HTTPS, and (2) The administration web page is protected with authentication.
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-41607)Record last updated .