CVE-2023-31446
In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 61.1%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized. This leads to injecting Bash code and executing it with root privileges on device startup.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 61.08% probability · 99th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-77
- Affected
- cassianetworks/xc1000 firmware · cassianetworks/xc2000 firmware
- Source
- cve@mitre.org
EPSS 61.1% since 3 November 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://blog.kscsc.online/cves/202331446/md.html
- https://github.com/Dodge-MPTC/CVE-2023-31446-Remote-Code-ExecutionExploit, Third Party Advisory
- https://www.cassianetworks.comProduct
- https://blog.kscsc.online/cves/202331446/md.html
- https://github.com/Dodge-MPTC/CVE-2023-31446-Remote-Code-ExecutionExploit, Third Party Advisory
- https://www.cassianetworks.comProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.