1. Home
  2. CVE Database
  3. CVE-2022-41607
MEDIUM · 6.2

CVE-2022-41607

All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s application programmable interface (API) is vulnerable to directory traversal through several different methods. This could al...

Vulnerability Description

All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s application programmable interface (API) is vulnerable to directory traversal through several different methods. This could allow an attacker to read sensitive files from the server, including SSH private keys, passwords, scripts, python objects, database files, and more.

CVSS Score

6.2

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
EtictelecomRemote Access Server Firmware<= 4.5.0
EtictelecomRas-C-100-Lw-
EtictelecomRas-E-100-
EtictelecomRas-E-220-
EtictelecomRas-E-400-
EtictelecomRas-Ec-220-Lw-
EtictelecomRas-Ec-400-Lw-
EtictelecomRas-Ec-480-Lw-
EtictelecomRas-Ecw-220-Lw-
EtictelecomRas-Ecw-400-Lw-
EtictelecomRas-Ew-100-
EtictelecomRas-Ew-220-
EtictelecomRas-Ew-400-
EtictelecomRfm-E-

Related Weaknesses (CWE)

CWE-22

References

FAQ

What is CVE-2022-41607?

CVE-2022-41607 is a vulnerability with a CVSS score of 6.2 (MEDIUM). All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s application programmable interface (API) is vulnerable to directory traversal through several different methods. This could al...

How severe is CVE-2022-41607?

CVE-2022-41607 has been rated MEDIUM with a CVSS base score of 6.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-41607?

Check the references section above for vendor advisories and patch information. Affected products include: Etictelecom Remote Access Server Firmware, Etictelecom Ras-C-100-Lw, Etictelecom Ras-E-100, Etictelecom Ras-E-220, Etictelecom Ras-E-400.