title: ETIC Telecom Remote Access Server Insufficient Verification of Data Authenticity
description: All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s web portal is vulnerable to accepting malicious firmware packages that could provide a backdoor to an attacker and provide privilege escalation to the device.
problem types: CWE-345 Insufficient Verification of Data Authenticity
affected:
{
defaultStatus: unaffected
product: Remote Access Server (RAS)
vendor: ETIC Telecom
versions:
lessThanOrEqual: 4.5.0, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
ETIC Telecom recommends updating the firmware of the affected devices to the following versions:
*  ETIC Telecom RAS:  version 4.7.0 or later https://www.etictelecom.com/en/softwares-download/
For the installed devices, ETIC Telecom recommends:
*  For all firmware versions 4.7.0 and above, there is a code signature verification for firmware packages. For versions prior to 4.7.0, to reduce the attack surface, we advise the user to verify: (1) That the downloaded firmware comes from a trusted source (ETIC Telecom web site), and (2) The hash of the firmware files.