Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain a command injection vulnerability via the Ping parameter at ping_exec.cgi.

Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain a command injection vulnerability via the Ping parameter at ping_exec.cgi.

SkyBridge MB-A100/A110/A200/A130 SkySpider MB-R210 provided by Seiko Solutions Inc. contain multiple vulnerabilities listed below. <ul> <li>Exposure of sensitive information to an unauthorized actor (CWE-200) - CVE-2016-2183 <li>Command injection (CWE-77) - CVE-2022-36556 <li>Unrestricted upload of file with dangerous type (CWE-434) - CVE-2022-36557 <li>Use of hard-coded credentials (CWE-798) - CVE-2022-36558 <li>Command injection (CWE-77) - CVE-2022-36559 <li>Use of hard-coded credentials (CWE-798) - CVE-2022-36560 <li>Improper privilege management (CWE-269) - CVE-2023-22361 <li>Missing authentication for critical function (CWE-306) - CVE-2023-22441 <li>Improper access control (CWE-284) - CVE-2023-23578 <li>Improper following of a certificate's chain of trust (CWE-296) - CVE-2023-23901 <li>Missing authentication for critical function (CWE-306) - CVE-2023-23906 <li>Cleartext storage of sensitive information (CWE-312) - CVE-2023-24586 <li>Cleartext transmission of sensitive information (CWE-319) - CVE-2023-25070 <li>Use of weak credentials (CWE-1391) - CVE-2023-25072 <li>Use of weak credentials (CWE-1391) - CVE-2023-25184 </ul> The developer states that attacks exploiting CVE-2022-36556 have been observed. CVE-2023-22441 MASAHIRO IIDA of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2016-2183, CVE-2022-36556, CVE-2022-36557, CVE-2022-36558, CVE-20…