CVE-2023-31446: Cassia Gateway firmware command injection in queueUrl parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction, public exploit code, and very high EPSS make this an urgent remote root compromise risk.

What it is

The queueUrl parameter in /bypass/config on Cassia XC1000 and XC2000 gateways is not sanitized, allowing injection of Bash code. The injected command executes with root privileges when the device starts, giving an unauthenticated network attacker full control of the device.

Impact

An attacker can execute arbitrary commands as root on the gateway, leading to full compromise of confidentiality, integrity and availability. This can be used to pivot into the network the gateway serves.

Attack surface

Reachable over the network via the /bypass/config endpoint with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The injected payload runs at device startup.

Exploitation

A public exploit exists (GitHub reference tagged Exploit), and EPSS is 0.61 (99th percentile), indicating high likelihood of exploitation. The CVE is not listed in CISA KEV.

What to do

• Apply the vendor firmware update for XC1000 and XC2000 that sanitizes the queueUrl parameter; contact Cassia Networks if no fixed version is published.
• Restrict network access to the gateway management/config interface to trusted management networks only.
• Monitor and alert on unexpected reboots or startup script changes on the devices.
• If patching is not possible, isolate affected gateways on a segmented VLAN with no access to sensitive internal systems.

Detection

• Inspect /bypass/config requests for shell metacharacters or unexpected commands in the queueUrl parameter.
• Monitor device logs and startup scripts for injected Bash commands or unexpected process execution as root.
• Alert on configuration changes to the queueUrl parameter outside of approved maintenance windows.
• Watch for outbound connections from gateway devices to unknown hosts that could indicate post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.