PT-2022-23467 · Seiko · Seiko Skybridge Mb-A100/A110

Published 2022-08-29 · Updated 2022-09-02 · CVE-2022-36558

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Seiko SkyBridge MB-A100/A110 versions 4.2.0 and below

Description The issue concerns a hard-coded passcode for the root account, which can be accessed by attackers through the file /etc/ciel.cfg.

Recommendations For versions 4.2.0 and below, consider changing the hard-coded passcode for the root account to a unique and secure password, and restrict access to the file /etc/ciel.cfg to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-36558

Affected Products

Seiko Skybridge Mb-A100/A110

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-36558 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36558 · Vendor Advisory
• https://seiko-sol.co.jp/products/skybridge/lineup/mb-a100 · Vendor Advisory
• https://gist.github.com/Nwqda/88232102fed50b54c43871e88e993b54 · Note
• https://t.me/cibsecurity/49014 · Telegram Post