« Volver al listado

CVE-2024-32850

Estado: AplazadaCrítica (9.8)—

Improper neutralization of special elements used in a command ('Command Injection') exists in SkyBridge MB-A100/MB-A110 firmware Ver. 4.2.2 and earlier and SkyBridge BASIC MB-A130 firmware Ver. 1.5.5 and earlier. If the remote monitoring and control function is enabled on the product, an attacker with access to the product may execute an arbitrary command or login to the product with the administrator privilege.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Skybridge — Mb-a100AISkybridge — Mb-a110AISkybridge — Mb-a130AI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-32850",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-32850",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-31T16:32:25.573045Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "Seiko Solutions Inc.",
          "product": "SkyBridge MB-A100/MB-A110",
          "versions": [
            {
              "status": "affected",
              "version": "firmware Ver. 4.2.2 and earlier"
            }
          ]
        },
        {
          "vendor": "Seiko Solutions Inc.",
          "product": "SkyBridge BASIC MB-A130",
          "versions": [
            {
              "status": "affected",
              "version": "firmware Ver. 1.5.5 and earlier"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:o:seiko-sol:skybridge_basic_mb-a130_firmware:-:*:*:*:*:*:*:*"
          ],
          "vendor": "seiko-sol",
          "product": "skybridge_basic_mb-a130_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "1.5.5"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:o:seiko-sol:skybridge_mb-a110_firmware:-:*:*:*:*:*:*:*"
          ],
          "vendor": "seiko-sol",
          "product": "skybridge_mb-a110_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "4.2.2"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-31T02:15:08.843",
  "references": [
    {
      "url": "https://jvn.jp/en/vu/JVNVU94872523/",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.seiko-sol.co.jp/archives/82992/",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/vu/JVNVU94872523/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.seiko-sol.co.jp/archives/82992/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper neutralization of special elements used in a command ('Command Injection') exists in SkyBridge MB-A100/MB-A110 firmware Ver. 4.2.2 and earlier and SkyBridge BASIC MB-A130 firmware Ver. 1.5.5 and earlier. If the remote monitoring and control function is enabled on the product, an attacker with access to the product may execute an arbitrary command or login to the product with the administrator privilege."
    },
    {
      "lang": "es",
      "value": "Existe una neutralización inadecuada de elementos especiales utilizados en un comando (\"Inyección de comando\") en la versión del firmware SkyBridge MB-A100/MB-A110 4.2.2 y anteriores y el firmware SkyBridge BASIC MB-A130 Ver. 1.5.5 y anteriores. Si la función de control y supervisión remota está habilitada en el producto, un atacante con acceso al producto puede ejecutar un comando arbitrario o iniciar sesión en el producto con privilegios de administrador."
    }
  ],
  "lastModified": "2026-06-17T07:30:32.843",
  "sourceIdentifier": "vultures@jpcert.or.jp"
}