By failing to authenticate three times to an unconfigured Abilis CPX device via SSH, an attacker can login to a restricted shell on the fourth attempt, and from there, relay connections.
CVSS 3.1MEDIUM 6.5·Network·No auth·No interaction·EPSS 0.00328·Published 2025-11-04·Fixed in 9.0.7CWE-1188