CVE-2023-46327 Weak cryptography in Apeos 1860 Japan Model
Attackers can decrypt exported address book data to obtain server credentials due to insufficient encryption strength in affected multifunction printers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-46327?
CVE-2023-46327 is a medium-severity vulnerability in FUJIFILM Business Inovation Corp. Apeos 1860 Japan Model, published on 2 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp. and Xerox Corporation provide a facility to export the contents of their Address Book with encrypted form, but the encryption strength is insufficient. With the knowledge of the encryption process and the encryption key, the information such as the server credentials may be obtained from the exported Address Book data. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
Weakness: CWE-287
Which versions are affected by CVE-2023-46327?
It affects 93 products.
Products include Fujifilm Apeos 2560 Firmware, Fujifilm Apeos 2560 Gk Firmware, Fujifilm Apeos 3060 Firmware, Fujifilm Apeos 3060 Gk Firmware, Fujifilm Apeos 3560 Firmware, Fujifilm Apeos 3560 Gk Firmware and 87 more.
How do I fix CVE-2023-46327?
No fix has been published for CVE-2023-46327 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-46327 being exploited?
There is no known exploitation of CVE-2023-46327 in the wild and no public exploit code.
Sources
Also known as GHSA-2qwp-p482-jjpc.