PT-2023-8650 · Kyocera · Kyocera Device Manager
Jordan Hedges
·
Published
2023-12-22
·
Updated
2024-01-19
·
CVE-2023-50916
CVSS v2.0
8.3
High
| Vector | AV:N/AC:L/Au:M/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Kyocera Device Manager versions prior to 3.1.1213.0
Description
The issue is related to incorrect restriction of a directory path with limited access. Exploitation may allow a remote attacker to bypass the authentication process. The vulnerability can be exploited by intercepting and modifying a request via a proxy or sending the request directly to the application endpoint, allowing UNC paths to be set for the backup location. This could lead to NTLM credential relaying or cracking attacks, depending on the environment configuration.
Recommendations
For Kyocera Device Manager versions prior to 3.1.1213.0, update to version 3.1.1213.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the UNC path authentication feature until a patch is available. Avoid using the `` (backslash) character in pathname configurations to minimize the risk of exploitation.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Kyocera Device Manager