Aggregates CVE and security vulnerability intelligence across all seiko-sol-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Common weakness patterns include vendor risk command injection, with potential vendor impact file overwrite across vendor surface production workloads and vendor surface software deployment use cases.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2023-25184 | Use of weak credentials exists in Seiko Solutions SkyBridge and SkySpider series, which may allow a remote unauthenticated attacker to decrypt password for the WebUI of the product. Affected products and versions are as follows: SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, SkyBridge BASIC MB-A130 firmware Ver. 1.4.1 and earlier, and SkySpider MB-R210 firmware Ver. 1.01.00 and earlier. | [email protected] | 7.5 | 1.19% | 2023-05-10 | 2025-01-28 |
| CVE-2023-25072 | Use of weak credentials exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unauthenticated attacker to decrypt password for the WebUI of the product. | [email protected] | 7.5 | 1.19% | 2023-05-10 | 2025-01-28 |
| CVE-2023-25070 | Cleartext transmission of sensitive information exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier. If the telnet connection is enabled, a remote unauthenticated attacker may eavesdrop on or alter the administrator's communication to the product. | [email protected] | 6.5 | 0.38% | 2023-05-10 | 2025-01-28 |
| CVE-2023-24586 | Cleartext storage of sensitive information exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote authenticated attacker to obtain an APN credential for the product. | [email protected] | 6.5 | 0.27% | 2023-05-10 | 2025-01-28 |
| CVE-2023-23906 | Missing authentication for critical function exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unauthenticated attacker to execute some critical functions without authentication, e.g., rebooting the product. | [email protected] | 7.5 | 1.56% | 2023-05-10 | 2025-01-28 |
| CVE-2023-23901 | Improper following of a certificate's chain of trust exists in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, and SkyBridge BASIC MB-A130 firmware Ver. 1.4.1 and earlier, which may allow a remote unauthenticated attacker to eavesdrop on or alter the communication sent to the WebUI of the product. | [email protected] | 6.5 | 0.48% | 2023-05-10 | 2025-01-28 |
| CVE-2023-23578 | Improper access control vulnerability in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier allows a remote unauthenticated attacker to connect to the product's ADB port. | [email protected] | 7.5 | 0.50% | 2023-05-10 | 2025-01-28 |
| CVE-2023-22441 | Missing authentication for critical function exists in Seiko Solutions SkyBridge series, which may allow a remote attacker to obtain or alter the setting information of the product or execute some critical functions without authentication, e.g., rebooting the product. Affected products and versions are as follows: SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, and SkyBridge BASIC MB-A130 firmware Ver. 1.4.1 and earlier | [email protected] | 8.6 | 1.76% | 2023-05-10 | 2025-01-28 |
| CVE-2023-22361 | Improper privilege management vulnerability in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier allows a remote authenticated attacker to alter a WebUI password of the product. | [email protected] | 6.5 | 1.46% | 2023-05-10 | 2025-01-28 |
| CVE-2022-36560 | Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain multiple hard-coded passcodes for root. Attackers are able to access the passcodes at /etc/srapi/config/system.conf and /usr/sbin/ssol-sshd.sh. | [email protected] | 9.8 | 0.46% | 2022-08-29 | 2024-11-21 |
| CVE-2022-36559 | Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain a command injection vulnerability via the Ping parameter at ping_exec.cgi. | [email protected] | 9.8 | 2.15% | 2022-08-29 | 2024-11-21 |
| CVE-2022-36558 | Seiko SkyBridge MB-A100/A110 v4.2.0 and below implements a hard-coded passcode for the root account. Attackers are able to access the passcord via the file /etc/ciel.cfg. | [email protected] | 9.8 | 0.46% | 2022-08-29 | 2024-11-21 |
| CVE-2022-36557 | Seiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain an arbitrary file upload vulnerability via the restore backup function. This vulnerability allows attackers to execute arbitrary code via a crafted html file. | [email protected] | 9.8 | 1.44% | 2022-08-29 | 2024-11-21 |
| CVE-2022-36556 | Seiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain a command injection vulnerability via the ipAddress parameter at 07system08execute_ping_01. | [email protected] | 9.8 | 2.15% | 2022-08-29 | 2024-11-21 |