CVE-2024-26155: ETIC Telecom RAS Information Disclosure

CVE-2024-26155 Overview

CVE-2024-26155 affects all versions of the ETIC Telecom Remote Access Server (RAS) firmware prior to 4.5.0. The web portal exposes clear text credentials within HTML source code that is configured to be hidden from the rendered page. An authenticated attacker accessing the portal can view the underlying HTML and retrieve credentials that permit connection to the ETIC RAS SSH server. This SSH access could enable an attacker to perform actions on the device beyond the intended web portal scope. The weakness is classified as [CWE-319]: Cleartext Transmission of Sensitive Information.

Critical Impact
Exposure of clear text SSH credentials in the RAS web portal allows lateral movement to the device shell, enabling configuration changes on industrial remote access equipment.

Affected Products

ETIC Telecom Remote Access Server (RAS) firmware, all versions prior to 4.5.0
Deployments referenced in CISA ICS Advisory ICSA-22-307-01
Industrial control environments using ETIC RAS for remote maintenance

Discovery Timeline

2025-01-17 - CVE-2024-26155 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-26155

Vulnerability Analysis

The ETIC Telecom Remote Access Server web portal embeds credentials directly into the HTML delivered to the browser. Portal designers marked the relevant HTML elements as hidden, relying on client-side rendering to conceal the values from casual viewing. This design assumes attackers cannot inspect the raw HTML. Any user with access to the web portal can bypass the concealment by opening browser developer tools or viewing the page source.

Once recovered, the exposed credentials authorize connections to the device's SSH server. SSH access provides a broader command surface than the web portal, including shell-level operations on the underlying operating system. Because the RAS device brokers remote access into industrial networks, compromise of the SSH interface can extend attacker reach into downstream operational technology assets. The vendor resolved the issue in firmware release 4.5.0.

Root Cause

The root cause is storage of authentication material in client-delivered HTML without server-side access controls. Hiding elements with CSS or attribute flags provides no security boundary. Credentials required to reach the SSH service should never be transmitted to browser clients regardless of visibility settings.

Attack Vector

The attack requires network access to the web portal and valid portal authentication. After logging in, the attacker inspects HTML source and extracts the hidden credential fields. The attacker then authenticates to the SSH service on the same device using the recovered credentials, gaining a scope of access beyond that granted by the web portal role.

No verified public proof-of-concept is available. Refer to CISA ICS Advisory ICSA-22-307-01 for vendor-coordinated technical detail on the ETIC RAS platform.

Detection Methods for CVE-2024-26155

Indicators of Compromise

SSH authentication events on ETIC RAS devices from source addresses not associated with authorized administrators
Web portal sessions immediately followed by SSH connections from the same source IP
Configuration changes on RAS devices outside of scheduled maintenance windows
Unexpected outbound connections from the RAS device toward internal OT assets

Detection Strategies

Inspect web server access logs for repeated GET requests to portal pages by low-privilege accounts, which may indicate HTML scraping
Correlate portal authentication events with subsequent SSH logins from the same source address within short time windows
Alert on any SSH session to the RAS management interface originating from a subnet that should only reach the web portal

Monitoring Recommendations

Forward RAS syslog data, SSH authentication logs, and web portal audit trails to a centralized SIEM for correlation
Track firmware version inventory across all ETIC RAS devices and flag any unit below 4.5.0
Monitor network flows between IT segments and the RAS management plane for protocol anomalies

How to Mitigate CVE-2024-26155

Immediate Actions Required

Upgrade all ETIC Telecom RAS devices to firmware version 4.5.0 or later
Rotate all credentials configured on affected RAS devices, including SSH accounts, after upgrading
Restrict web portal and SSH exposure to management networks using firewall rules or VPN concentrators
Audit historical access logs for unauthorized SSH sessions to affected devices

Patch Information

ETIC Telecom addressed the vulnerability in Remote Access Server firmware version 4.5.0. Consult the vendor for firmware distribution and consult CISA ICS Advisory ICSA-22-307-01 for coordinated guidance on ETIC RAS deployments.

Workarounds

Place the RAS web portal behind a VPN or jump host so only trusted administrators can authenticate
Disable the SSH service on the RAS device if it is not required for operations
Enforce network access control lists that limit inbound TCP/22 to a defined administrator source list
Require multi-factor authentication at an upstream gateway when firmware-level MFA is unavailable

bash

# Example firewall rule limiting SSH exposure to a management subnet
iptables -A INPUT -p tcp --dport 22 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP