PT-2023-5722 · Unknown · Cassia Access Controller

Published 2023-09-26 · Updated 2024-01-29 · CVE-2023-35793

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cassia Access Controller version 2.1.1.2303271039

Description The issue is related to insufficient authentication of executed requests in the Cassia Access Controller, which can allow a remote attacker to perform a Cross Site Request Forgery (CSRF) attack. This can be exploited when establishing a web SSH session to gateways.

Recommendations For Cassia Access Controller version 2.1.1.2303271039, consider disabling the web SSH session establishment to gateways as a temporary workaround until a patch is available. Restrict access to the gateway configuration to minimize the risk of exploitation. Avoid using the web SSH session feature in the affected version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2023-06392

CVE-2023-35793

Affected Products

Cassia Access Controller

References · 10

• 🔥 https://github.com/Dodge-MPTC/CVE-2023-35793-CSRF-On-Web-SSH · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-35793 · Security Note
• https://osv.dev/vulnerability/CVE-2023-35793 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06392 · Security Note
• https://t.me/cvenotify/69149 · Telegram Post
• https://t.me/cybersecuritytechnologies/9098 · Telegram Post
• https://twitter.com/CVEnew/status/1706851425005789422 · Twitter Post
• https://twitter.com/hack_git/status/1706933833176629685 · Twitter Post
• https://blog.kscsc.online/cves/202335793/md.html · Note
• https://cassianetworks.com/products/iot-access-controller · Note