CVE-2025-35021

Medium · 6.5

CVSS

6.5

EPSS

0.3%

Published

Nov 4, 2025

CISA due date

—

The record

By failing to authenticate three times to an unconfigured Abilis CPX device via SSH, an attacker can login to a restricted shell on the fourth attempt, and from there, relay connections.

Affected packages

Ecosystem	Package	Introduced	Fixed