Bizhub 226I Firmware
CVE-2022-29586
HIGH
Severity by source
AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Konica Minolta bizhub MFP devices before 2022-04-14 allow a Sandbox Escape. An attacker must attach a keyboard to a USB port, press F12, and then escape from the kiosk mode.
AnalysisAI
Konica Minolta bizhub MFP devices before 2022-04-14 allow a Sandbox Escape. Rated high severity (CVSS 7.4), this vulnerability is low attack complexity. No vendor patch available.
Technical ContextAI
Konica Minolta bizhub MFP devices before 2022-04-14 allow a Sandbox Escape. An attacker must attach a keyboard to a USB port, press F12, and then escape from the kiosk mode. Affected products include: Konicaminolta Bizhub 226I Firmware, Konicaminolta Bizhub 227 Firmware, Konicaminolta Bizhub 246I Firmware, Konicaminolta Bizhub 287 Firmware, Konicaminolta Bizhub 306I Firmware. Version information: before 2022.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Bizhub 226I Firmware
View allKonica Minolta bizhub MFP devices before 2022-04-14 have an internal Chromium browser that executes with root (aka super
Konica Minolta bizhub MFP devices before 2022-04-14 use cleartext password storage for the /var/log/nginx/html/ADMINPASS
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today