PT-2023-20382 · Google+3 · Android+3

Published 2023-04-13 · Updated 2023-04-21 · CVE-2023-25954

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions KYOCERA Mobile Print versions 3.2.0.230119 and earlier UTAX/TA MobilePrint versions 3.2.0.230119 and earlier Olivetti Mobile Print versions 3.2.0.230119 and earlier

Description The issue is related to improper intent handling. When a malicious app is installed on the victim user's Android device, it may send an intent and direct the affected app to download malicious files or apps to the device without notification.

Recommendations For KYOCERA Mobile Print versions 3.2.0.230119 and earlier, consider disabling the intent handling feature until a patch is available. For UTAX/TA MobilePrint versions 3.2.0.230119 and earlier, restrict access to the app's download functionality to minimize the risk of exploitation. For Olivetti Mobile Print versions 3.2.0.230119 and earlier, avoid using the app to download files or apps from untrusted sources until the issue is resolved. As a temporary workaround, consider uninstalling the affected apps until a patch is available.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2023-25954

Affected Products

Android

Kyocera Mobile Print

Olivetti Mobile Print

Utax/Ta Mobileprint

References · 8

• https://osv.dev/vulnerability/CVE-2023-25954 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25954 · Security Note
• https://kyoceradocumentsolutions.com/en/our-business/security/information/2023-04-11.html · Vendor Advisory
• https://t.me/cibsecurity/62053 · Telegram Post
• https://play.google.com/store/apps/details?id=com.kyocera.kyoprintolivetti · Note
• https://play.google.com/store/apps/details?id=com.kyocera.kyoprint · Note
• https://jvn.jp/en/vu/JVNVU98434809 · Note
• https://play.google.com/store/apps/details?id=com.kyocera.kyoprinttautax · Note