High severity · published Mar 12, 2024
CVE-2024-21805
Improper access control vulnerability exists in the specific folder of SKYSEA Client View versions from Ver.16.100 prior to Ver.19.2
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Improper access control vulnerability exists in the specific folder of SKYSEA Client View versions from Ver.16.100 prior to Ver.19.2. If this vulnerability is exploited, an arbitrary file may be placed in the specific folder by a user who can log in to the PC where the product's Windows client is installed. In case the file is a specially crafted DLL file, arbitrary code may be executed with SYSTEM privilege.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Skysea Client View · Skygroup
16.100.06f before 19.300.09h · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-21805
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-21805
Third Party Advisory
https://jvn.jp/en/jp/JVN54451757/
Vendor Advisory
https://www.skyseaclientview.net/news/240307_01/
More from Skysea Client View
9.8
CVE-2016-7836
SKYSEA Client View Improper Authentication Vulnerability
7.8
CVE-2026-39454
SKYSEA Client View and SKYMEC IT Manager provided by Sky Co.,LTD
7.8
CVE-2024-41143
Origin validation error vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e
7.8
CVE-2024-41139
Incorrect privilege assignment vulnerability exists in SKYSEA Client View Ver.6.010.06 to Ver.19.210.04e
7.8
CVE-2021-20616
Untrusted search path vulnerability in the installer of SKYSEA Client View Ver.1.020.05b to Ver.16.001.01g allows an attacker to gain privileges via a Trojan horse DLL in an…