CVE-2023-24586

Vulnerability

CVE-2023-24586 is a cleartext storage of sensitive information vulnerability in Seiko Solutions SkyBridge MB-A100 and MB-A110 routers. The vulnerability exists in firmware version 4.2.0 and earlier. The product stores the APN (Access Point Name) credential, which includes the username and password used for cellular network authentication, in cleartext (unencrypted) within the device's configuration or storage. An attacker with remote authenticated access to the device can retrieve this credential.

Exploitation

To exploit this vulnerability, an attacker must first obtain valid remote authentication credentials for the SkyBridge MB-A100 or MB-A110 device (e.g., via the web management interface). Once authenticated, the attacker can access the configuration or file storage where the APN credential is stored in cleartext. No additional privileges or user interaction beyond the initial authentication are required. The exact sequence may involve navigating the web UI or downloading a configuration file. The vulnerability is exposed over the network as the device provides remote management capabilities.

Impact

Successful exploitation allows the remote authenticated attacker to read the APN credential (username and password) stored in cleartext. This could lead to unauthorized use of the mobile network connection (e.g., hijacking the cellular data session, incurring data charges, or accessing the mobile carrier's network). The attacker gains the ability to impersonate the device on the cellular network, potentially enabling further attacks or information disclosure. The confidentiality of the credential is fully compromised.

Mitigation

According to the vendor's download pages [1][2], firmware versions for the affected product lines have been updated in subsequent releases, but the specific fixed version for MB-A100/110 addressing CVE-2023-24586 is not explicitly disclosed in the available references. The vendor recommends upgrading to the latest firmware version available from the official download portal [2]. If a fixed version is not yet available for the specific model, users should restrict remote management access to trusted networks and implement strong authentication. No workaround is described in the sources.