CVE-2016-7836: critical vulnerability in SKYSEA Client View
Published · Updated
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
SKYSEA Client View versions 11.221.03 and earlier have a flaw in how they verify user credentials when connecting to the management console over TCP. An attacker can bypass authentication and execute arbitrary code remotely on affected systems.
The vulnerability exists in the authentication processing mechanism for TCP connections between SKYSEA Client View and its management console. An unauthenticated attacker can exploit improper credential verification to achieve remote code execution. The attack requires network access to the management console port but does not require valid credentials.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.