Multiple vulnerabilities in SKYSEA Client View
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2024-41139 CVE-2024-41143 CVE-2024-41726 |
| CWE-ID | CWE-266 CWE-346 CWE-22 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
SKYSEA Client View Client/Desktop applications / Other client software |
| Vendor | Sky Co., LTD. |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Incorrect Privilege Assignment
EUVDB-ID: #VU94816
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-41139
CWE-ID:
CWE-266 - Incorrect Privilege Assignment
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper access control in the specific process. A local user can place a specially crafted DLL file in a specific folder and execute arbitrary code with SYSTEM privilege.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSKYSEA Client View: 6.010.06
External linkshttp://jvn.jp/en/jp/JVN84326763/index.html
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Origin validation error
EUVDB-ID: #VU94817
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-41143
CWE-ID:
CWE-346 - Origin Validation Error
Exploit availability: No
DescriptionThe vulnerability allows a local user to compromise the target system.
The vulnerability exists due to missing origin validation in shared memory data exchanges. A local user can execute arbitrary code with SYSTEM privilege.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSKYSEA Client View: 3.013.00
External linkshttp://jvn.jp/en/jp/JVN84326763/index.html
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Path traversal
EUVDB-ID: #VU94818
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-41726
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences. A remote user can send a specially crafted HTTP request and read arbitrary files on the system, leading to arbitrary code execution.
MitigationInstall update from vendor's website.
Vulnerable software versionsSKYSEA Client View: 15.200.13i
External linkshttp://jvn.jp/en/jp/JVN84326763/index.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
