CVE-2023-3453
ETIC Telecom Insecure Default Initialization of Resource
- Published
- Updated
- Reserved
- Assigned by
- icscert
Description
ETIC Telecom RAS versions 4.7.0 and prior the web management portal authentication disabled by default. This could allow an attacker with adjacent network access to alter the configuration of the device or cause a denial-of-service condition.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| icscertCNA (assigner) | 3.1 | High7.1 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L |
| NVDNVD · Modified | 3.1 | High8.1 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.34% · top 73% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.
Weakness
Affected products
ETIC Telecom · Remote Access Server (RAS)
- affected ≤ 4.7.0
What to do
Solution: Update to ETIC Telecom RAS: version 4.9.0 or later https://www.etictelecom.com/en/softwares-download/
Workaround: ETIC Telecom recommends enabling the authentication mechanism on the administration interface. This can be done on the page “> Setup > Security > Administration right” by creating an administrator on the “List of administrators” table, enabling the parameter “Password protect the configuration interface,” then setting the parameter “Protocols to use for configuration” to “HTTPs only”. NOTE: for firmware versions 4.9.0 or later, enabling the administration protection is mandatory after the first product start.
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-3453)Record last updated .