CVE-2023-31446

In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized. This leads to injecting Bash code and executing it with root privileges on device startup.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 99%
VendorProductVersion
cassianetworksxc1000_firmware
2.1.1.2303082218
cassianetworksxc2000_firmware
2.1.1.2303090947
𝑥
= Vulnerable software versions
References
https://blog.kscsc.online/cves/202331446/md.html
https://github.com/Dodge-MPTC/CVE-2023-31446-Remote-Code-Execution
https://www.cassianetworks.com
https://blog.kscsc.online/cves/202331446/md.html
https://github.com/Dodge-MPTC/CVE-2023-31446-Remote-Code-Execution
https://www.cassianetworks.com