Published:2022/11/01  Last Updated:2022/11/01

Multiple vulnerabilities in the web interfaces of Kyocera Document Solutions MFPs and printers


The web interfaces of multiple MFPs and printers provided by KYOCERA Document Solutions Inc. contain multiple vulnerabilities.

Products Affected

A wide range of products are affected.
For more information, refer to the information provided by the developer.


The web interface "Command Center" of multiple MFPs and printers provided by KYOCERA Document Solutions Inc. contain multiple vulnerabilities listed below.

  • Session Information Easily Guessable (CWE-287) - CVE-2022-41798
    CVSS v3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Base Score: 6.3
    CVSS v2 AV:A/AC:L/Au:N/C:P/I:P/A:P Base Score: 5.8
  • Missing authorization (CWE-425) - CVE-2022-41807
    CVSS v3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Base Score: 5.4
    CVSS v2 AV:A/AC:L/Au:N/C:P/I:P/A:N Base Score: 4.8
  • Stored cross-site scripting (CWE-79) - CVE-2022-41830
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Base Score: 4.8
    CVSS v2 AV:N/AC:M/Au:S/C:N/I:P/A:N Base Score: 3.5


  • A network-adjacent attacker may log in to the product - CVE-2022-41798
  • A network-adjacent attacker may modify the product settings without authentication - CVE-2022-41807
  • An arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege - CVE-2022-41830


Update the firmware
Update the firmware to the latest version according to the information provided by the developer.
For more information, contact your distributor.

Apply the workaround
Ensure the network connection is safe to avoid access from any untrusted peers.

  • Connect to a firewall-protected network
  • Connect to a network with a private IP address

Vendor Status

Vendor Link
KYOCERA Document Solutions Inc. Security vulnerabilities in our products


JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC


Takayuki Sasaki, Takaya Noma and Katsunari Yoshioka of Yokohama National University reported these vulnerabilities to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Reports
CERT Advisory
CPNI Advisory
CVE CVE-2022-41798
JVN iPedia JVNDB-2022-000079