PT-2025-27506 · Konica Minolta · Konica Minolta Bizhub 227

Deral Heiland · Published 2025-07-01 · Updated 2025-07-01 · CVE-2025-6081

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Konica Minolta bizhub 227 Multifunction printers version GCQ-Y3 or earlier

Description: The issue concerns insufficiently protected credentials in LDAP, allowing an attacker to reconfigure the target device to use an external LDAP service controlled by the attacker. If an LDAP password is set on the target device, the attacker can force the target device to authenticate to the attacker-controlled LDAP service, enabling the capture of the plaintext password of the configured LDAP service.

Recommendations: For version GCQ-Y3 or earlier, consider disabling the LDAP service until a patch is available to prevent reconfiguration by an attacker. Restrict access to the device's configuration to minimize the risk of exploitation. Avoid using the LDAP password on the target device until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2025-6081

Affected Products

Konica Minolta Bizhub 227

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-6081 · Security Note
• https://konicaminolta.com/global-en/security/advisory/pdf/km-2025-0003.pdf · Vendor Advisory
• https://t.me/cvetracker/27489 · Telegram Post
• https://twitter.com/CVEnew/status/1939909702210711929 · Twitter Post
• https://rapid7.com/blog/post/cve-2025-6081-konica-minolta-bizhub-pass-back-attack-vulnerability-not-fixed · Note
• https://t.me/cvenotify/127204 · Telegram Post