What is the CVSS score of CVE-2022-41798?

CVE-2022-41798 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Taskalfa 7550Ci Firmware CVE-2022-41798

MEDIUM

Authentication Bypass by Spoofing (CWE-290)

2022-12-05 vultures@jpcert.or.jp

Authentication Bypass Taskalfa 7550Ci Firmware Taskalfa 6550Ci Firmware Taskalfa 5550Ci Firmware Taskalfa 4550Ci Firmware Taskalfa 3550Ci Firmware Taskalfa 3050Ci Firmware Taskalfa 255C Firmware Taskalfa 205C Firmware Taskalfa 256Ci Firmware Taskalfa 206Ci Firmware Ecosys M6526Cdn Firmware Ecosys M6526Cidn Firmware Fs C2126Mfp Firmware Fs C2026Mfp Firmware Taskalfa 8000I Firmware Taskalfa 6500I Firmware Taskalfa 5500I Firmware Taskalfa 4500I Firmware Taskalfa 3500I Firmware Taskalfa 305 Firmware Taskalfa 255 Firmware Taskalfa 306I Firmware Taskalfa 256I Firmware Ls 3140Mfp Firmware Ls 3640Mfp Firmware Ecosys M2535Dn Firmware Ls 1135Mfp Firmware Ls 1035Mfp Firmware Ls C8650Dn Firmware Ls C8600Dn Firmware Ecosys P6026Cdn Firmware Fs C5250Dn Firmware Ls 4300Dn Firmware Ls 4200Dn Firmware Ls 2100Dn Firmware Ecosys P4040Dn Firmware Ecosys P2135Dn Firmware Fs 1370Dn Firmware

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Dec 05, 2022 - 04:15 nvd

MEDIUM 6.5

DescriptionNVD

Session information easily guessable vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to log in to the product by spoofing a user with guessed session information. Affected products/versions are as follows: TASKalfa 7550ci/6550ci, TASKalfa 5550ci/4550ci/3550ci/3050ci, TASKalfa 255c/205c, TASKalfa 256ci/206ci, ECOSYS M6526cdn/M6526cidn, FS-C2126MFP/C2126MFP+/C2026MFP/C2026MFP+, TASKalfa 8000i/6500i, TASKalfa 5500i/4500i/3500i, TASKalfa 305/255, TASKalfa 306i/256i, LS-3140MFP/3140MFP+/3640MFP, ECOSYS M2535dn, LS-1135MFP/1035MFP, LS-C8650DN/C8600DN, ECOSYS P6026cdn, FS-C5250DN, LS-4300DN/4200DN/2100DN, ECOSYS P4040dn, ECOSYS P2135dn, and FS-1370DN.

AnalysisAI

Session information easily guessable vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to log in to the product by spoofing a user with. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-290. Session information easily guessable vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to log in to the product by spoofing a user with guessed session information. Affected products/versions are as follows: TASKalfa 7550ci/6550ci, TASKalfa 5550ci/4550ci/3550ci/3050ci, TASKalfa 255c/205c, TASKalfa 256ci/206ci, ECOSYS M6526cdn/M6526cidn, FS-C2126MFP/C2126MFP+/C2026MFP/C2026MFP+, TASKalfa 8000i/6500i, TASKalfa 5500i/4500i/3500i, TASKalfa 305/255, TASKalfa 306i/256i, LS-3140MFP/3140MFP+/3640MFP, ECOSYS M2535dn, LS-1135MFP/1035MFP, LS-C8650DN/C8600DN, ECOSYS P6026cdn, FS-C5250DN, LS-4300DN/4200DN/2100DN, ECOSYS P4040dn, ECOSYS P2135dn, and FS-1370DN. Affected products include: Kyocera Taskalfa 7550Ci Firmware, Kyocera Taskalfa 6550Ci Firmware, Kyocera Taskalfa 5550Ci Firmware, Kyocera Taskalfa 4550Ci Firmware, Kyocera Taskalfa 3550Ci Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.