JVN#46345126
Multiple vulnerabilities in the web interfaces of Kyocera Document Solutions MFPs and printers

Overview

The web interfaces of multiple MFPs and printers provided by KYOCERA Document Solutions Inc. contain multiple vulnerabilities.

Products Affected

A wide range of products are affected.
For more information, refer to the information provided by the developer.

Description

The web interface "Command Center" of multiple MFPs and printers provided by KYOCERA Document Solutions Inc. contain multiple vulnerabilities listed below.

• Session Information Easily Guessable (CWE-287) - CVE-2022-41798

  CVSS v3	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	Base Score: 6.3
  CVSS v2	AV:A/AC:L/Au:N/C:P/I:P/A:P	Base Score: 5.8

• Missing authorization (CWE-425) - CVE-2022-41807

  CVSS v3	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	Base Score: 5.4
  CVSS v2	AV:A/AC:L/Au:N/C:P/I:P/A:N	Base Score: 4.8

• Stored cross-site scripting (CWE-79) - CVE-2022-41830

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N	Base Score: 4.8
  CVSS v2	AV:N/AC:M/Au:S/C:N/I:P/A:N	Base Score: 3.5

Impact

• A network-adjacent attacker may log in to the product - CVE-2022-41798
• A network-adjacent attacker may modify the product settings without authentication - CVE-2022-41807
• An arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege - CVE-2022-41830

Solution

Update the firmware
Update the firmware to the latest version according to the information provided by the developer.
For more information, contact your distributor.

Apply the workaround
Ensure the network connection is safe to avoid access from any untrusted peers.

• Connect to a firewall-protected network
• Connect to a network with a private IP address