CVE-2024-26155
Published: 17 January 2025
Summary
CVE-2024-26155 is a medium-severity Cleartext Transmission of Sensitive Information (CWE-319) vulnerability in Etictelecom Remote Access Server Firmware. Its CVSS base score is 6.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 21.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-26155 is a vulnerability in all versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 that exposes cleartext credentials within the web portal. The HTML code containing these credentials is configured to be hidden, but an attacker can access the ETIC RAS web portal and view the source code to obtain them. This issue corresponds to CWE-319 (Cleartext Transmission of Sensitive Information) and has a CVSS v3.1 base score of 6.8 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).
An attacker with network access and high privileges can exploit this vulnerability by accessing the web portal, inspecting the hidden HTML code to retrieve the cleartext credentials, and then using them to connect to the ETIC RAS SSH server. Successful exploitation enables the attacker to perform actions on the device, resulting in high confidentiality impact with a changed scope due to the credential exposure.
The CISA advisory ICSA-22-307-01 provides details on this vulnerability, and mitigation involves upgrading to ETIC Telecom RAS version 4.5.0 or later, which addresses the exposure of credentials in the web portal.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-23432
Vulnerability details
All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 expose clear text credentials in the web portal. An attacker can access the ETIC RAS web portal and view the HTML code, which is configured to be hidden,…
more
thus allowing a connection to the ETIC RAS ssh server, which could enable an attacker to perform actions on the device.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability directly exposes cleartext credentials in served HTML (enables T1552.001); retrieved credentials then allow SSH access (facilitates T1021.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification, reporting, and correction of the specific flaw exposing cleartext credentials, including installation of the patch to ETIC RAS version 4.5.0 or later.
Mandates protection of authenticator content from unauthorized disclosure and modification, preventing cleartext credentials from being embedded in the web portal's HTML source.
Requires establishment of secure configuration settings for the RAS web portal to avoid exposure of cleartext credentials in hidden HTML elements.