{"id":"CVE-2024-26155","aliases":["EUVD-2024-23432","GHSA-39g8-rv9x-hwgr"],"status":"published","title":"ETIC Telecom Remote Access Server (RAS) Cleartext Transmission of Sensitive Information","description":"All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 \nexpose clear text credentials in the web portal. An attacker can access \nthe ETIC RAS web portal and view the HTML code, which is configured to \nbe hidden, thus allowing a connection to the ETIC RAS ssh server, which \ncould enable an attacker to perform actions on the device.","severity":{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00243,"percentile":0.15669,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-319"],"published":"2025-01-17T16:19:37Z","modified":"2026-06-17T07:17:12Z","products":[{"vendor":"etic telecom","product":"remote access server (ras)"},{"vendor":"etictelecom","product":"remote_access_server_firmware"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-22-307-01","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26155"},{"url":"https://github.com/advisories/GHSA-39g8-rv9x-hwgr"}],"sources":{"cve":[{"id":"CVE-2024-26155","title":"ETIC Telecom Remote Access Server (RAS) Cleartext Transmission of Sensitive Information","description":"All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 \nexpose clear text credentials in the web portal. An attacker can access \nthe ETIC RAS web portal and view the HTML code, which is configured to \nbe hidden, thus allowing a connection to the ETIC RAS ssh server, which \ncould enable an attacker to perform actions on the device.","status":"published","published":"2025-01-17T16:19:37.43Z","modified":"2025-01-21T14:55:29.814Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T14:33:59.512321Z"}],"euvd":[{"id":"EUVD-2024-23432","description":"All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 \nexpose clear text credentials in the web portal. An attacker can access \nthe ETIC RAS web portal and view the HTML code, which is configured to \nbe hidden, thus allowing a connection to the ETIC RAS ssh server, which \ncould enable an attacker to perform actions on the device.","status":"published","published":"2025-01-17T16:19:37Z","modified":"2025-01-21T14:55:29Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-03T00:04:16.173755Z"}],"ghsa":[{"id":"GHSA-39g8-rv9x-hwgr","title":"All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 \nexpose clear text...","description":"All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 \nexpose clear text credentials in the web portal. An attacker can access \nthe ETIC RAS web portal and view the HTML code, which is configured to \nbe hidden, thus allowing a connection to the ETIC RAS ssh server, which \ncould enable an attacker to perform actions on the device.","status":"published","published":"2025-01-17T18:31:14Z","modified":"2025-01-17T18:31:22Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T14:59:35.754921Z"}],"nvd":[{"id":"CVE-2024-26155","description":"All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 \nexpose clear text credentials in the web portal. An attacker can access \nthe ETIC RAS web portal and view the HTML code, which is configured to \nbe hidden, thus allowing a connection to the ETIC RAS ssh server, which \ncould enable an attacker to perform actions on the device.","status":"published","published":"2025-01-17T17:15:11.327Z","modified":"2026-06-17T07:17:12.997Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T14:10:42.895329Z"}]}}