CVE-2023-25072 Hardcoded credentials in SkyBridge MB-A100/110
Remote attackers can decrypt WebUI passwords due to weak credentials, allowing unauthorized access to SkyBridge MB-A100/110 devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-25072?
CVE-2023-25072 is a medium-severity vulnerability in Seiko Solutions Inc. SkyBridge MB-A100/110, published on 10 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use of weak credentials exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unauthenticated attacker to decrypt password for the WebUI of the product.
Weakness: CWE-521
Which versions are affected by CVE-2023-25072?
It affects 2 products.
Products include Seiko-Sol Skybridge Mb-A100 Firmware, Seiko-Sol Skybridge Mb-A110 Firmware.
How do I fix CVE-2023-25072?
No fix has been published for CVE-2023-25072 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-25072 being exploited?
There is no known exploitation of CVE-2023-25072 in the wild and no public exploit code.
Other vulnerabilities in Seiko Solutions Inc. SkyBridge MB-A100/110
Sources
Also known as GHSA-4qvj-3p36-qxpv.