Bugs in the Cloud: How One Vulnerability Exposed ‘Offline’ Devices to a Security Risk

**Executive Summary:** Claroty Team82 discovered and disclosed a directory traversal vulnerability (CVE-2021-22685) in Cassia Networks' IoT Access Controller v1.4 that allowed unauthenticated attackers to read arbitrary files from the server container—potentially exposing configuration files, application source code, logs, and hashed passwords; dozens of cloud instances were found vulnerable before patches and Cassia released version 2.0 to remediate the issue.