ETIC Telecom Insecure Default Initialization of Resource
ETIC Telecom RAS versions 4.7.0 and prior the web management portal authentication disabled by default. This could allow an attacker with adjacent network access to alter the configuration of the device or cause a denial-of-service condition.
ETIC Telecom Insecure Default Initialization of Resource
ETIC Telecom RAS versions 4.7.0 and prior the web management portal authentication disabled by default. This could allow an attacker with adjacent network access to alter the configuration of the device or cause a denial-of-service condition.
Description: CWE-1188 Insecure Default Initialization of Resource
Metrics
Version
Base score
Base severity
Vector
3.1
7.1
HIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Version:3.1
Base score:7.1
Base severity: HIGH
Vector:
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Metrics Other Info
Impacts
CAPEC ID
Description
Solutions
Update to ETIC Telecom RAS: version 4.9.0 or later https://www.etictelecom.com/en/softwares-download/
Configurations
Workarounds
ETIC Telecom recommends enabling the authentication mechanism on the administration interface. This can be done on the page “> Setup > Security > Administration right” by creating an administrator on the “List of administrators” table, enabling the parameter “Password protect the configuration interface,” then setting the parameter “Protocols to use for configuration” to “HTTPs only”.
NOTE: for firmware versions 4.9.0 or later, enabling the administration protection is mandatory after the first product start.
ETIC Telecom RAS versions 4.7.0 and prior the web management portal authentication disabled by default. This could allow an attacker with adjacent network access to alter the configuration of the device or cause a denial-of-service condition.