CVE-2023-49367 PoC — Kyocera Command Center RX EXOSYS M5521cdn 安全漏洞

Description

Information Disclosure in user interface in Kyocera Command Center RX EXOSYS M5521cdn allows remote to access user information via inspecting sent packages by user.

介绍

# CVE-2023-49367 - Sensetive Data Exposure
Sensetive Data Exposure in Kyocera Printer Web Panel<br/>
Vendor: Kyocera Corporation<br/>
Affected Versions: Command Center RX - EXOSYS M5521cdn

# Description
After connecting to the Kyocera interface address book, test requests for smb and ftp can be seen in the sent packets. These requests contain plaintext passwords, and when examined, these plaintext passwords can be intercepted.

# POC
- Go to **Address Book* Page
- Click to any **Saved User**
- Press the test button for content with entered data
- Review incoming and outgoing requests and view plaintext password data

文件快照

备注