JVN#46345126: Multiple vulnerabilities in the web interfaces of Kyocera Document Solutions MFPs and printers

The web interface “Command Center” of multiple MFPs and printers provided by KYOCERA Document Solutions Inc. contain multiple vulnerabilities listed below.

Session Information Easily Guessable (CWE-287) - CVE-2022-41798

Missing authorization (CWE-425) - CVE-2022-41807

Stored cross-site scripting (CWE-79) - CVE-2022-41830

Impact

• A network-adjacent attacker may log in to the product - CVE-2022-41798
• A network-adjacent attacker may modify the product settings without authentication - CVE-2022-41807
• An arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege - CVE-2022-41830

Solution

Update the firmware
Update the firmware to the latest version according to the information provided by the developer.
For more information, contact your distributor.

Apply the workaround
Ensure the network connection is safe to avoid access from any untrusted peers.

• Connect to a firewall-protected network
• Connect to a network with a private IP address

Products Affected

A wide range of products are affected.
For more information, refer to the information provided by the developer.