Cassianetworks vulnerabilities
We track 3 vulnerabilities in Cassianetworks products across 3 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on January 10, 2024.
Latest Cassianetworks vulnerabilities
- 9.8 Critical severity
Xc1000 Firmware: Improper Neutralization of Special Elements used in a Command
In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized. This leads to injecting Bash code and executing it with root privileges on device startup.
- 8.8 High severity
Access Controller: Improper Authentication
An issue was discovered in Cassia Access Controller 2.1.1.2303271039. The Web SSH terminal endpoint (spawned console) can be accessed without authentication. Specifically, there is no session cookie validation on the Access Controller; instead, there is only B
- 8.8 High severity
Access Controller: Cross-Site Request Forgery
An issue was discovered in Cassia Access Controller 2.1.1.2303271039. Establishing a web SSH session to gateways is vulnerable to Cross Site Request Forgery (CSRF) attacks.