PT-2022-23469 · Seiko · Seiko Skybridge Mb-A200

Published 2022-08-29 · Updated 2024-01-09 · CVE-2022-36560

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Seiko SkyBridge MB-A200 versions 01.00.04 and below

Description The issue concerns multiple hard-coded passcodes for root access. Attackers can obtain these passcodes from /etc/srapi/config/system.conf and /usr/sbin/ssol-sshd.sh.

Recommendations For versions 01.00.04 and below, consider changing the hard-coded passcodes to unique, secure passwords to prevent unauthorized root access. As a temporary workaround, restrict access to the files /etc/srapi/config/system.conf and /usr/sbin/ssol-sshd.sh to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-36560

Affected Products

Seiko Skybridge Mb-A200

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-36560 · Security Note
• https://seiko-sol.co.jp/products/skybridge/lineup/mb-a200 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36560 · Vendor Advisory
• https://t.me/cvenotify/35386 · Telegram Post
• https://t.me/aptreports/7232 · Telegram Post
• https://t.me/cvenotify/35656 · Telegram Post
• https://t.me/cibsecurity/49015 · Telegram Post
• https://gist.github.com/Nwqda/0db1fc6cfa39d7f0592d44e18c40146e · Note