Actively exploited · Published Jun 9, 2017 · Assigned by jpcert
CVE-2016-7836
Critical 9.8 Exploited
In plain English
A critical-severity improper authentication in SKYSEA Client View from Sky Co., LTD.. Attackers are actively exploiting it in the wild (listed by CISA on October 14, 2025). The chance it is exploited in the next 30 days is estimated at 19.2% (higher than 97% of all known vulnerabilities). Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Nov 4, 2025.
Official description
SKYSEA Client View Ver.11.221.03 and earlier allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Sky Co., LTD. | SKYSEA Client View | Ver.11.221.03 and earlier |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.skyseaclientview.net/news/161221/ x_refsource_CONFIRM
- https://www.skygroup.jp/security-info/170308.html x_refsource_CONFIRM
- JVN#84995847 third-party-advisory, x_refsource_JVN
- 95062 vdb-entry, x_refsource_BID
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7836 government-resource