CVE-2023-23901

Vulnerability

A chain-of-trust verification flaw exists in the WebUI of Seiko Solutions SkyBridge MB-A200 (firmware version 01.00.05 and earlier) and SkyBridge BASIC MB-A130 (firmware version 1.4.1 and earlier) [1][3]. The device does not properly follow the certificate chain when establishing TLS connections, which means it may accept certificates that are not signed by a trusted root authority.

Exploitation

A remote, unauthenticated attacker can exploit this weakness by performing a man-in-the-middle (MITM) attack against the communication between the WebUI and the device. No prior authentication or special network position is required beyond being able to intercept network traffic (e.g., on the same network segment or through a compromised upstream hop).

Impact

Successful exploitation allows the attacker to eavesdrop on all WebUI traffic and, depending on the intercepted session, alter data exchanged with the device. This compromises the confidentiality and integrity of management communications, potentially exposing administrative credentials or device configuration.

Mitigation

Seiko Solutions has released firmware version 1.7.4 for the MB-A130 (as of May 2026) and version 01.03.01 for the MB-A200 (as of February 2026) [1][3]. Users should update to these fixed versions or later. If updating is not immediately possible, restrict network access to the WebUI to trusted hosts only and avoid using it over untrusted networks.