The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has provided technical details and mitigations for multiple critical vulnerabilities in Industrial Control System (ICS) software utilized by the France-based ETIC Telecom. The news stems from an advisory published by CISA on November 3, 2022, highlighting the vulnerabilities affecting the company. There are three (3) vulnerabilities impacting ETIC Telecom’s Remote Access Server (RAS). The first vulnerability, tracked as CVE-2022-3703, received a CVSS score of 9/10 and is an insufficient verification of data authenticity flaw affecting all versions of ETIC Telecom RAS 4.5.0 and earlier. If exploited, a threat actor could pass a maliciously crafted firmware package, bypassing authentication which could allow backdoor access to the target system. The second vulnerability, tracked as CVE-2022-41607, has a CVSS score of 8.6/10 and is a path traversal flaw, allowing threat actors to access sensitive files and directories stored outside of the web application’s root folder. If exploited, threat actors could potentially access critical system and configuration files, and even the application source code. The final vulnerability received a CVSS score of 8.3/10 and is an unrestricted file upload of dangerous type flaw tracked as CVE-2022-40981, which occurs when an application fails to validate or improperly validates file types before uploading them to the system. A dangerous file type is one that can be processed automatically in the target environment; a threat actor could exploit this vulnerability to read arbitrary files and upload malicious files to the target environment. ETIC Telecom has patched these flaws, and their customers are urged to ensure they are running ETIC Telecom RAS version 4.7. This was one (1) of three (3) advisories published by CISA concerning companies utilizing ICS software, with the other two (2) advisories concerning Nokia and Delta Industrial Automation. Information about all of the advisories can be found in the CISA link below.