CVE-2023-22361

Vulnerability

An improper privilege management vulnerability exists in SkyBridge MB-A100 and MB-A110 routers running firmware version 4.2.0 and earlier [2]. The flaw allows a remote authenticated attacker to alter the WebUI password of the device without proper authorization checks.

Exploitation

An attacker must first obtain valid credentials for the WebUI (e.g., default or previously compromised credentials). Once authenticated, the attacker can exploit the missing privilege separation to change the administrator password, effectively locking out legitimate users or gaining persistent access.

Impact

Successful exploitation enables the attacker to modify the WebUI password, leading to denial of service for authorized administrators and potential further compromise of the router's configuration and network access.

Mitigation

As of the publication date (2023-05-10), no firmware update addressing this vulnerability has been disclosed in the available references. Users should monitor the vendor's download page [2] for future patches and consider restricting WebUI access to trusted networks.