Read the docs
TI-2024-21723 Aliases CVE-2024-32850GHSA-rg5r-x6g3-c6xm

OS command injection in Seiko Solutions Inc. SkyBridge MB-A100/MB-A110

Priority MEDIUM 51CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-78.

Summary

Improper neutralization of special elements used in a command ('Command Injection') exists in SkyBridge MB-A100/MB-A110 firmware Ver. 4.2.2 and earlier and SkyBridge BASIC MB-A130 firmware Ver. 1.5.5 and earlier. If the remote monitoring and control function is enabled on the product, an attacker with access to the product may execute an arbitrary command or login to the product with the administrator privilege.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01207 68th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Seiko Solutions Inc.SkyBridge MB-A100/MB-A110firmware Ver. 4.2.2 and earlier—No fix listedCNA
Seiko Solutions Inc.SkyBridge BASIC MB-A130firmware Ver. 1.5.5 and earlier—No fix listedCNA
  • SkyBridge MB-A100/MB-A110 VendorSeiko Solutions Inc. Affected firmware Ver. 4.2.2 and earlier Fixed in — No fix listed CNA
  • SkyBridge BASIC MB-A130 VendorSeiko Solutions Inc. Affected firmware Ver. 1.5.5 and earlier Fixed in — No fix listed CNA

CPE names CISA-ADP · 2

CPEVersionsRoleVendor
cpe:2.3:o:seiko-sol:skybridge_basic_mb-a130_firmware:-:*:*:*:*:*:*:*not specified by CISA-ADP—Seiko Solutions Inc.
cpe:2.3:o:seiko-sol:skybridge_mb-a110_firmware:-:*:*:*:*:*:*:*not specified by CISA-ADP—Seiko Solutions Inc.
  • cpe:2.3:o:seiko-sol:skybridge_basic_mb-a130_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Seiko Solutions Inc.
  • cpe:2.3:o:seiko-sol:skybridge_mb-a110_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Seiko Solutions Inc.

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-32850
  2. 2026-10-03 Alias added: GHSA-rg5r-x6g3-c6xm

References

Other 2

  • TI-2023-08623 Improper privilege management vulnerability in SkyBridge MB-A100/110 firmware Ver. CVSS 3.1MEDIUM 6.5
  • TI-2025-34591 OS command injection in Seiko Solutions Inc. SkyBridge BASIC MB-A130 CVSS 4.0CRITICAL 9.3
  • TI-2022-16872 Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain a command injection… CVSS 3.1CRITICAL 9.8
  • TI-2023-08693 Missing authentication in Seiko Solutions Inc. SkyBridge MB-A200 and SkyBridge BASIC… CVSS 3.1HIGH 8.6
  • TI-2022-16869 Seiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain a command… CVSS 3.1CRITICAL 9.8
  • TI-2022-16873 Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain multiple hard-coded… CVSS 3.1CRITICAL 9.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences