PT-2022-9264 · Cassia Networks · Cassia Networks Access Controller

Amir Preminger + 1 · Published 2022-10-14 · Updated 2022-10-15 · CVE-2021-22685

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cassia Networks Access Controller versions prior to 2.0.1

Description An attacker may be able to use the minify route with a relative path to view any file on the system.

Recommendations For versions prior to 2.0.1, update to version 2.0.1 or later to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-22685

Affected Products

Cassia Networks Access Controller

References · 5

• https://cassianetworks.com/support/knowledge-base · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22685 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22685 · Vendor Advisory
• https://t.me/cibsecurity/51453 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-21-119-02 · Note