CVE-2026-68062: Path Traversal
SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected products installed and can receive UDP packets from that system. Note that this vulnerability is due to an incomplete fix for CVE-2024-41726.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to cross-system code execution?
The attack path involves a Windows system where an affected product is installed and the attacker can log in, plus another Windows system with an affected product installed that can receive UDP packets from the first system.
What access does an attacker need?
An attacker needs the ability to log in to a Windows system on which an affected product is installed. Exploitation also depends on reaching another affected Windows system that can receive UDP packets from that logged-in system.
Is remote exploitation possible without prior access?
The provided information describes a prerequisite of logging in to an affected Windows system. It does not describe exploitation by an unauthenticated attacker directly from the network.
What is the impact if exploitation succeeds?
The attacker may be able to execute arbitrary code on another affected Windows system. The listed impact includes high confidentiality, integrity, and availability effects, with scope changed.
Why should organizations that addressed CVE-2024-41726 review their remediation?
This issue is identified as an incomplete fix for CVE-2024-41726. Systems believed to be protected by the earlier remediation may therefore still require review against this vulnerability.