PT-2022-23466 · Seiko · Seiko Skybridge Mb-A100/A110

Published 2022-08-29 · Updated 2022-09-02 · CVE-2022-36557

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Seiko SkyBridge MB-A100/A110 versions 4.2.0 and below

Description The issue allows attackers to execute arbitrary code via a crafted html file, exploiting an arbitrary file upload vulnerability through the restore backup function.

Recommendations For versions 4.2.0 and below, consider disabling the restore backup function until a patch is available to prevent exploitation of the arbitrary file upload vulnerability.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-36557

Affected Products

Seiko Skybridge Mb-A100/A110

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-36557 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36557 · Vendor Advisory
• https://seiko-sol.co.jp/products/skybridge/lineup/mb-a100 · Vendor Advisory
• https://t.me/cibsecurity/49011 · Telegram Post
• https://t.me/cvenotify/35401 · Telegram Post
• https://gist.github.com/Nwqda/88232102fed50b54c43871e88e993b54 · Note