We combine professional expertise with a human kind of partnership
Personalised technology solutions to help your organisation gain a competitive advantage
Benefit from smart ideas, lower costs, greater productivity. Choose from award-winning printers, software solutions and consumables
Get the right help and advice, register a product and see why our commitment to you matters.
Discover our brand, our global activities and commitments
We are writing to inform you that a security vulnerability has been confirmed in KYOCERA Command Center RX (hereinafter referred to as "CCRX"), which allows users to check and change various settings of multifunction devices provided by Kyocera Document Solutions over the network. The following is an overview of the issue and how to resolve it. As of the date of publication of this notice, we have not confirmed any attacks that take advantage of this vulnerability.
1. Path Traversal
CCRX has a Path Traversal vulnerability. Path Traversal is an attack on web applications. By manipulating the value of the file path, an attacker can gain access to the file system, including source code and critical system settings.
Vulnerability number: CVE-2023-34259
2. Denial of Service (DoS)
There is a vulnerability that makes CCRX unusable by a DoS attack. By manipulating the value of the file path, CCRX may become unresponsive.
Vulnerability number: CVE-2023-34260
3. User Enumeration
By trying to login many times, an attacker can grasp if there is a login user name in data base for device at CCRX login.
Vulnerability number: CVE-2023-34261
As a countermeasure, we provide firmware that fixed Vulnerability issues. Please contact your local distributor to apply the firmware. As for “3. User Enumeration”, Kyocera Document Solutions recognizes that security risk is low level.
Kyocera Document Solutions would like to thank Mr. Stefan Michlits of SEC Consult, an Austrian security consulting services company, who discovered this vulnerability.
For more information on how this vulnerability affects products, please contact your local distributor where you purchased the product.