[Japanese]

JVNDB-2022-000079

Multiple vulnerabilities in the web interfaces of Kyocera Document Solutions MFPs and printers

Overview

The web interface "Command Center" of multiple MFPs and printers provided by KYOCERA Document Solutions Inc. contain multiple vulnerabilities listed below.


  • Session Information Easily Guessable (CWE-287) - CVE-2022-41798

  • Missing authorization (CWE-425) - CVE-2022-41807

  • Stored cross-site scripting (CWE-79) - CVE-2022-41830



Takayuki Sasaki, Takaya Noma and Katsunari Yoshioka of Yokohama National University reported these vulnerabilities to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 6.3 (Medium) [IPA Score]
  • Attack Vector: Adjacent Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low
CVSS V2 Severity:
Base Metrics 5.8 (Medium) [IPA Score]
  • Access Vector: Adjacent Network
  • Access Complexity: Low
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: Partial
  • Availability Impact: Partial
The above CVSS base scores have been assigned for CVE-2022-41798

CVSS V3 Severity:
Base Metrics 5.4 (Medium) [IPA Score]
  • Attack Vector: Adjacent Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None
CVSS V2 Severity:
Base Metrics 4.8 (Medium) [IPA Score]
  • Access Vector: Adjacent Network
  • Access Complexity: Low
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: Partial
  • Availability Impact: None
The above CVSS base scores have been assigned for CVE-2022-41807

CVSS V3 Severity:
Base Metrics 4.8 (Medium) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: Required
  • Scope: Changed
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None
CVSS V2 Severity:
Base Metrics 3.5 (Low) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Medium
  • Authentication: Single
  • Confidentiality Impact: None
  • Integrity Impact: Partial
  • Availability Impact: None
The above CVSS base scores have been assigned for CVE-2022-41830
Affected Products


KYOCERA Document Solutions
  • (multiple product)

    A wide range of products are affected.
Impact


  • A network-adjacent attacker may log in to the product - CVE-2022-41798
  • A network-adjacent attacker may modify the product settings without authentication - CVE-2022-41807
  • An arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege - CVE-2022-41830

Solution

[Update the firmware]
Update the firmware to the latest version according to the information provided by the developer.
For more information, contact your distributor.

[Apply the workaround]
Ensure the network connection is safe to avoid access from any untrusted peers.

  • Connect to a firewall-protected network
  • Connect to a network with a private IP address
Vendor Information

KYOCERA Document Solutions
CWE (What is CWE?)

  1. Improper Authentication(CWE-287) [IPA Evaluation]
  2. Cross-site Scripting(CWE-79) [IPA Evaluation]
  3. No Mapping(CWE-Other) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2022-41798
  2. CVE-2022-41807
  3. CVE-2022-41830
References

  1. JVN : JVN#46345126
  2. National Vulnerability Database (NVD) : CVE-2022-41798
  3. National Vulnerability Database (NVD) : CVE-2022-41807
  4. National Vulnerability Database (NVD) : CVE-2022-41830
Revision History

  • [2022/11/01]
      Web page was published
  • [2024/06/06]
      References : Contents were added

Date Public2022/11/01
Date First Published2022/11/01
Date Last Updated2024/06/06