Vulnerability · Published Dec 5, 2022 · Assigned by jpcert
CVE-2022-41798
Medium 6.5
In plain English
A medium-severity authentication bypass by spoofing in Kyocera Document Solutions MFPs and printers from KYOCERA Document Solutions Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Official description
Session information easily guessable vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to log in to the product by spoofing a user with guessed session information. Affected products/versions are as follows: TASKalfa 7550ci/6550ci, TASKalfa 5550ci/4550ci/3550ci/3050ci, TASKalfa 255c/205c, TASKalfa 256ci/206ci, ECOSYS M6526cdn/M6526cidn, FS-C2126MFP/C2126MFP+/C2026MFP/C2026MFP+, TASKalfa 8000i/6500i, TASKalfa 5500i/4500i/3500i, TASKalfa 305/255, TASKalfa 306i/256i, LS-3140MFP/3140MFP+/3640MFP, ECOSYS M2535dn, LS-1135MFP/1035MFP, LS-C8650DN/C8600DN, ECOSYS P6026cdn, FS-C5250DN, LS-4300DN/4200DN/2100DN, ECOSYS P4040dn, ECOSYS P2135dn, and FS-1370DN.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| KYOCERA Document Solutions Inc. | Kyocera Document Solutions MFPs and printers | A wide range of products is affected. For the specific products/versions information, see the URL provided by the vendor which is listed in [Reference] section. |
Weakness: CWE-290 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N