CVE-2022-41807 Missing authorization in Kyocera Document Solutions MFPs and printers
A network-adjacent attacker can alter device settings without authentication due to missing authorization checks in Kyocera MFPs and printers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-41807?
CVE-2022-41807 is a medium-severity missing authorization vulnerability in Kyocera Document Solutions MFPs and printers, published on 5 Dec 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Missing authorization vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to alter the product settings without authentication by sending a specially crafted request. Affected products/versions are as follows: TASKalfa 7550ci/6550ci, TASKalfa 5550ci/4550ci/3550ci/3050ci, TASKalfa 255c/205c, TASKalfa 256ci/206ci, ECOSYS M6526cdn/M6526cidn, FS-C2126MFP/C2126MFP+/C2026MFP/C2026MFP+, TASKalfa 8000i/6500i, TASKalfa 5500i/4500i/3500i, TASKalfa 305/255, TASKalfa 306i/256i, LS-3140MFP/3140MFP+/3640MFP, ECOSYS M2535dn, LS-1135MFP/1035MFP, LS-C8650DN/C8600DN, ECOSYS P6026cdn, FS-C5250DN, LS-4300DN/4200DN/2100DN, ECOSYS P4040dn, ECOSYS P2135dn, and FS-1370DN.
Weakness: CWE-862
Which versions are affected by CVE-2022-41807?
It affects 40 products.
Products include Kyocera Ecosys M2535dn Firmware, Kyocera Ecosys M6526cdn Firmware, Kyocera Ecosys M6526cidn Firmware, Kyocera Ecosys P2135dn Firmware, Kyocera Ecosys P4040dn Firmware, Kyocera Ecosys P6026cdn Firmware and 34 more.
How do I fix CVE-2022-41807?
No fix has been published for CVE-2022-41807 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-41807 being exploited?
There is no known exploitation of CVE-2022-41807 in the wild and no public exploit code.
Other vulnerabilities in Kyocera Document Solutions MFPs and printers
Sources
Also known as GHSA-26rq-fvc6-cmqf.