What’s Vulnerable › Vulnerabilities
CVE-2023-35794
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2023-10-27 · updated 2026-06-17
- Weakness: CWE-287
Description
An issue was discovered in Cassia Access Controller 2.1.1.2303271039. The Web SSH terminal endpoint (spawned console) can be accessed without authentication. Specifically, there is no session cookie validation on the Access Controller; instead, there is only Basic Authentication to the SSH console.
Affected products
- Cassia Networks Access Controller: 2.1.1.2303271039
References
- https://blog.kscsc.online/cves/202335794/md.html
- https://github.com/Dodge-MPTC/CVE-2023-35794-WebSSH-Hijacking
- https://www.cassianetworks.com/products/iot-access-controller/
- https://blog.kscsc.online/cves/202335794/md.html
- https://github.com/Dodge-MPTC/CVE-2023-35794-WebSSH-Hijacking
- https://www.cassianetworks.com/products/iot-access-controller/
Get alerted when CVE-2023-35794 or the next vulnerability affects your stack