PT-2022-11909 · Fujifilm · Fujifilm Docucentre-Vi C4471

Giuliano Fasto · Published 2022-03-03 · Updated 2022-05-13 · CVE-2021-43774

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fujifilm DocuCentre-VI C4471 version 1.8

Description A risky-algorithm issue allows an attacker with access to the administrative web interface to download the address book file, containing a list of users and their encrypted passwords. The passwords are protected by a weak cipher, such as ROT13, which can be easily decrypted to obtain valid domain or FTP usernames and passwords.

Recommendations For Fujifilm DocuCentre-VI C4471 version 1.8, consider changing the default credentials and restricting access to the administrative web interface to minimize the risk of exploitation. Additionally, avoid using weak ciphers like ROT13 for password protection until a more secure alternative is implemented. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2021-43774

Affected Products

Fujifilm Docucentre-Vi C4471

References · 6

• 🔥 https://foregenix.com/blogs-new-2021/dude-its-just-a-printer · Exploit
• https://fujifilm.com/fbglobal/eng/company/news/notice/2022/0302_addressbook_announce.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43774 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43774 · Security Note
• https://t.me/cibsecurity/38358 · Telegram Post
• https://foregenix.com/blog · Note