title: ETIC Telecom Remote Access Server Unrestricted Upload of File with Dangerous Type
description: All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior is vulnerable to malicious file upload. An attacker could take advantage of this to store malicious files on the server, which could override sensitive and useful existing files on the filesystem, fill the hard disk to full capacity, or compromise the affected device or computers with administrator level privileges connected to the affected device.
problem types: CWE-434 Unrestricted Upload of File with Dangerous Type
affected:
{
defaultStatus: unaffected
product: Remote Access Server (RAS)
vendor: ETIC Telecom
versions:
lessThanOrEqual: 4.5.0, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
ETIC Telecom recommends updating the firmware of the affected devices to the following versions:
*  ETIC Telecom RAS:  version 4.7.0 or later https://www.etictelecom.com/en/softwares-download/
For the installed devices, ETIC Telecom recommends:
*  For all firmware versions 4.7.0 and above, only valid configuration files can be uploaded to the device. For versions prior to 4.7.0, to reduce the attack surface, we advise the user to verify in the router configuration that: (1) The administration web page is accessible only through the LAN side over HTTPS, and (2) The administration web page is protected with authentication.