CVE-2023-35794

Vulnerability

Cassia Access Controller version 2.1.1.2303271039 uses WebSSH2 to establish SSH sessions from the AC to gateways. The WebSSH endpoint at /ssh/host does not validate the session cookie. Instead, only Basic Authentication is required, allowing unauthorized users to hijack an existing WebSSH session [1][2].

Exploitation

An attacker with network access can hijack a WebSSH session by knowing the SSH username and password (often default credentials like cassia:cassia-). The session establishment is triggered via a GET request to /ap/remote/?ssh_port=, and the attacker can then access the console using Basic Auth without a valid session cookie [1][2].

Impact

Successful exploitation allows an attacker to gain unauthorized access to the gateway device via the hijacked SSH session, potentially leading to full control over the gateway and connected IoT devices [1][2].

Mitigation

The vendor confirmed the issue and fixed it in version 2.1.1.2308181707. Users should upgrade to the patched version immediately [1][2]. No workaround is mentioned in the available references.