CVE-2023-3453 : ETIC Telecom RAS versions 4.7.0 and prior the web management portal authenticati

ETIC Telecom RAS versions 4.7.0 and prior the web management portal authentication disabled by default. This could allow an attacker with adjacent network access to alter the configuration of the device or cause a denial-of-service condition.

Published 2023-08-23 22:15:09

Updated 2023-12-28 19:26:18

Source ICS-CERT

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2023-3453

Etictelecom » Remote Access Server Firmware
Versions up to, including, (<=) 4.7.0
cpe:2.3:o:etictelecom:remote_access_server_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Etictelecom » Ras-c-100-lw » Version: N/A
When used together with: Etictelecom » Ras-e-100 » Version: N/A
When used together with: Etictelecom » Ras-e-220 » Version: N/A
When used together with: Etictelecom » Ras-e-400 » Version: N/A
When used together with: Etictelecom » Ras-ec-220-lw » Version: N/A
When used together with: Etictelecom » Ras-ec-400-lw » Version: N/A
When used together with: Etictelecom » Ras-ec-480-lw » Version: N/A
When used together with: Etictelecom » Ras-ecw-220-lw » Version: N/A
When used together with: Etictelecom » Ras-ecw-400-lw » Version: N/A
When used together with: Etictelecom » Ras-ew-100 » Version: N/A
When used together with: Etictelecom » Ras-ew-220 » Version: N/A
When used together with: Etictelecom » Ras-ew-400 » Version: N/A
When used together with: Etictelecom » Rfm-e » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-3453

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 12 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-3453

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.1	HIGH	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L	2.8	3.7	ICS-CERT
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: Low Integrity: Low Availability: Low
8.1	HIGH	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H	2.8	5.2	NIST
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: High

CWE ids for CVE-2023-3453

CWE-1188 Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

Assigned by: ics-cert@hq.dhs.gov (Primary)

References for CVE-2023-3453

https://www.cisa.gov/news-events/ics-advisories/icsa-23-208-01

ETIC Telecom RAS Authentication | CISA
Patch;Third Party Advisory;US Government Resource

Jump to

Vulnerability Details : CVE-2023-3453

Products affected by CVE-2023-3453

Exploit prediction scoring system (EPSS) score for CVE-2023-3453

CVSS scores for CVE-2023-3453

CWE ids for CVE-2023-3453

References for CVE-2023-3453