CVE-2025-54857 (CVSS 9.8): Critical Flaw in Seiko Solutions Device Allows Remote Takeover

A critical security flaw, CVE-2025-54857 (CVSS 9.8), has been found in SkyBridge BASIC MB-A130 networking devices from Seiko Solutions Inc, with firmware versions 1.5.8 and earlier affected, according to the advisory. The vulnerability stems from insufficient input validation, allowing remote, unauthenticated attackers to inject OS commands and potentially gain root privileges, enabling complete control over the device’s operating system.

If exploited, attackers could install persistent backdoors, alter device configurations, intercept or manipulate traffic, and launch attacks against other connected systems. Seiko Solutions has released a patched firmware, with the fixed version listed as SkyBridge BASIC MB-A130 Ver. 1.6.0, and administrators are urged to apply the update immediately, especially for devices exposed to untrusted networks. According to the advisory, the flaw could be exploited without authentication, underscoring the risk of remote takeover.