JVN#20721579 advisory

jvn.jp • July 5, 2026

SkyBridge MB-A100/MB-A110 provided by Seiko Solutions Inc. contains an OS command injection vulnerability.

SkyBridge MB-A100/MB-A110 provided by Seiko Solutions Inc. contains the following vulnerability. OS command injection ( CWE-78 ) CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.6 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 7.2 CVE-2026-50043

An arbitrary OS command may be executed by an attacker who can log in to the product with an administrative privilege.

Apply the Workaround SkyBridge MB-A100/MB-A110 is no longer supported, and no firmware update to address this vulnerability will be released. If the affected product remains in use, apply the following workarounds to mitigate the impact of this vulnerability. Change the default administrator password Disable WebUI access Restrict the IP addresses that can access the product from the WAN Use a closed network For more details, refer to the information provided by the developer.

Takeshi Kuramori and Kaori Takashima of National Institute of Information and Communications Technology, Cybersecurity Research Institute reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

JPCERT Alert JPCERT Reports CERT Advisory CPNI Advisory TRnotes CVE CVE-2026-50043 JVN iPedia JVNDB-2026-000091

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Seiko SkyBridge IoT Routers Face Permanent OS Injection Vulnerability Seiko Solutions' SkyBridge MB-A100 and MB-A110 routers are affected by a high-severity OS command injection vulnerability (CVE-2026-50043) disclosed on July 1, 2026. The flaw allows authenticated attackers to execute arbitrary OS commands via the web administration interface. Seiko has confirmed that no firmware patch will be released, leaving these devices permanently vulnerable. This is the third significant OS command injection vulnerability discovered in this product line, following CVE-2022-36556 and CVE-2025-29635. Organizations using these routers are advised to take immediate action to mitigate risks, as the devices may still retain default credentials or weak passwords. The vulnerability has a CVSS base score of 8.6, indicating a high severity level. The advisory was coordinated by JPCERT/CC and Japan's Information-Technology Promotion Agency. 2 sources 71

Extracted Entities

JVN#20721579 advisory

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)