CVE-2022-41830 Cross-site scripting in Kyocera Document Solutions MFPs and printers
Remote authenticated administrators can inject arbitrary scripts into Kyocera MFPs and printers, enabling stored cross-site scripting attacks.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-41830?
CVE-2022-41830 is a medium-severity cross-site scripting vulnerability in Kyocera Document Solutions MFPs and printers, published on 5 Dec 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Stored cross-site scripting vulnerability in Kyocera Document Solutions MFPs and printers allows a remote authenticated attacker with an administrative privilege to inject arbitrary script. Affected products/versions are as follows: TASKalfa 7550ci/6550ci, TASKalfa 5550ci/4550ci/3550ci/3050ci, TASKalfa 255c/205c, TASKalfa 256ci/206ci, ECOSYS M6526cdn/M6526cidn, FS-C2126MFP/C2126MFP+/C2026MFP/C2026MFP+, TASKalfa 8000i/6500i, TASKalfa 5500i/4500i/3500i, TASKalfa 305/255, TASKalfa 306i/256i, LS-3140MFP/3140MFP+/3640MFP, ECOSYS M2535dn, LS-1135MFP/1035MFP, LS-C8650DN/C8600DN, ECOSYS P6026cdn, FS-C5250DN, LS-4300DN/4200DN/2100DN, ECOSYS P4040dn, ECOSYS P2135dn, and FS-1370DN.
Weakness: CWE-79
Which versions are affected by CVE-2022-41830?
It affects 40 products.
Products include Kyocera Ecosys M2535dn Firmware, Kyocera Ecosys M6526cdn Firmware, Kyocera Ecosys M6526cidn Firmware, Kyocera Ecosys P2135dn Firmware, Kyocera Ecosys P4040dn Firmware, Kyocera Ecosys P6026cdn Firmware and 34 more.
How do I fix CVE-2022-41830?
No fix has been published for CVE-2022-41830 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-41830 being exploited?
There is no known exploitation of CVE-2022-41830 in the wild and no public exploit code.
Other vulnerabilities in Kyocera Document Solutions MFPs and printers
Sources
Also known as GHSA-6qmr-4c46-qjhp.