CVE-2023-22441

Vulnerability

Missing authentication for critical functions exists in Seiko Solutions SkyBridge series, specifically MB-A200 firmware Ver. 01.00.05 and earlier, and MB-A130 firmware Ver. 1.4.1 and earlier. This allows an unauthenticated remote attacker to interact with the device's management interfaces [1][3].

Exploitation

An attacker with network access to the device can send crafted requests to the vulnerable management functions without any authentication. No user interaction is required. The attacker can enumerate or modify settings, or trigger actions such as rebooting the device.

Impact

Successful exploitation leads to unauthorized access to configuration information (confidentiality), alteration of device settings (integrity), and disruption of service via reboot (availability). The attacker gains full control over the affected functions without needing any credentials.

Mitigation

Seiko Solutions has released firmware updates: MB-A130 firmware version 1.7.4 [1] and MB-A200 firmware version 01.03.01 [3]. However, the vendor does not explicitly state that these updates address this vulnerability. Users should apply the latest firmware and restrict network access to the device. No workaround is documented.