CVE-2023-22441 Missing authorization in SkyBridge MB-A200 and SkyBridge BASIC MB-A130
Remote attackers can access critical functions and modify settings without authentication on Seiko SkyBridge devices, potentially causing service disruption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-22441?
CVE-2023-22441 is a high-severity missing authorization vulnerability in Seiko Solutions Inc. SkyBridge MB-A200 and SkyBridge BASIC MB-A130, published on 10 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing authentication for critical function exists in Seiko Solutions SkyBridge series, which may allow a remote attacker to obtain or alter the setting information of the product or execute some critical functions without authentication, e.g., rebooting the product. Affected products and versions are as follows: SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, and SkyBridge BASIC MB-A130 firmware Ver. 1.4.1 and earlier
Weakness: CWE-306
Which versions are affected by CVE-2023-22441?
It affects 2 products.
Products include Seiko-Sol Skybridge Basic Mb-A130 Firmware, Seiko-Sol Skybridge Mb-A200 Firmware.
How do I fix CVE-2023-22441?
No fix has been published for CVE-2023-22441 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-22441 being exploited?
There is no known exploitation of CVE-2023-22441 in the wild and no public exploit code.
Other vulnerabilities in Seiko Solutions Inc. SkyBridge MB-A200 and SkyBridge BASIC MB-A130
Sources
Also known as GHSA-qwcg-gr98-8m32.