Vulnerability · Published May 10, 2023 · Assigned by jpcert
CVE-2023-23901
Medium 4.8
In plain English
A medium-severity improper certificate validation in SkyBridge MB-A200 and SkyBridge BASIC MB-A130 from Seiko Solutions Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Official description
Improper following of a certificate's chain of trust exists in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, and SkyBridge BASIC MB-A130 firmware Ver. 1.4.1 and earlier, which may allow a remote unauthenticated attacker to eavesdrop on or alter the communication sent to the WebUI of the product.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Seiko Solutions Inc. | SkyBridge MB-A200 and SkyBridge BASIC MB-A130 | SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, and SkyBridge BASIC MB-A130 firmware Ver. 1.4.1 and earlier |
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://www.seiko-sol.co.jp/archives/73969/
- https://www.seiko-sol.co.jp/products/skybridge/skybridge_download/mb-a100/
- https://www.seiko-sol.co.jp/products/skybridge/skybridge_download/mb-a200/
- https://www.seiko-sol.co.jp/products/skybridge/skybridge_download/mb-a130/
- https://www.seiko-sol.co.jp/products/skyspider/skyspider_download/mb-r210/
- https://jvn.jp/en/jp/JVN40604023/