CVE-2022-29587 Privilege escalation in n/a

Medium 4.0 Published 16 May 2022 Updated 3 Aug 2024

An internal Chromium browser in Konica Minolta MFP devices runs with root privileges, allowing attackers to escalate privileges and execute arbitrary code.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-29587?

CVE-2022-29587 is a medium-severity vulnerability in n/a, published on 16 May 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Konica Minolta bizhub MFP devices before 2022-04-14 have an internal Chromium browser that executes with root (aka superuser) access privileges.

Weakness: CWE-269

Which versions are affected by CVE-2022-29587?

It affects 45 products.

Products include Konicaminolta Bizhub 226i Firmware, Konicaminolta Bizhub 227 Firmware, Konicaminolta Bizhub 246i Firmware, Konicaminolta Bizhub 287 Firmware, Konicaminolta Bizhub 306i Firmware, Konicaminolta Bizhub 308 Firmware and 39 more.

How do I fix CVE-2022-29587?

No fix has been published for CVE-2022-29587 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-29587 being exploited?

There is no known exploitation of CVE-2022-29587 in the wild and no public exploit code.

Sources

Also known as GHSA-3mqc-6cqg-j6mm.