What is CVE-2024-32850?

CVE-2024-32850 is a critical-severity vulnerability in Seiko Solutions Inc. Skybridge Basic Mb-A130, classified under OS Command Injection. CVSS score: 9.8/10. Published 2024-05-31.

How severe is CVE-2024-32850?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Seiko Solutions Inc. Skybridge Basic Mb-A130

CVE-2024-32850

Improper neutralization of special elements used in a command ('Command Injection') exists in SkyBridge MB-A100/MB-A110 firmware Ver. 4.2.2 and earlier and SkyBridge BASIC MB-A130 firmware Ver. 1.5.5 and earlier. If the remote monitoring and control function is enabled on the product, an attacker with access to the product may execute an arbitrary command or login to the product with the administrator privilege.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.012 (65.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Seiko Solutions Inc. Skybridge Basic Mb-a130 — versions firmware Ver. 1.5.5 and earlier
Seiko Solutions Inc. Skybridge Mb-a100/mb-a110 — versions firmware Ver. 4.2.2 and earlier

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

Frequently asked questions

What is CVE-2024-32850?: CVE-2024-32850 is a critical-severity vulnerability in Seiko Solutions Inc. Skybridge Basic Mb-A130, classified under OS Command Injection. CVSS score: 9.8/10. Published 2024-05-31.
How severe is CVE-2024-32850?: Critical severity. CVSS v3 base score is 9.8 out of 10.