What is the CVSS score of CVE-2022-41830?

CVE-2022-41830 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.8%.

Taskalfa 7550Ci Firmware CVE-2022-41830

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2022-12-05 vultures@jpcert.or.jp

XSS Taskalfa 7550Ci Firmware Taskalfa 6550Ci Firmware Taskalfa 5550Ci Firmware Taskalfa 4550Ci Firmware Taskalfa 3550Ci Firmware Taskalfa 3050Ci Firmware Taskalfa 255C Firmware Taskalfa 205C Firmware Taskalfa 256Ci Firmware Taskalfa 206Ci Firmware Ecosys M6526Cdn Firmware Ecosys M6526Cidn Firmware Fs C2126Mfp Firmware Fs C2026Mfp Firmware Taskalfa 8000I Firmware Taskalfa 6500I Firmware Taskalfa 5500I Firmware Taskalfa 4500I Firmware Taskalfa 3500I Firmware Taskalfa 305 Firmware Taskalfa 255 Firmware Taskalfa 306I Firmware Taskalfa 256I Firmware Ls 3140Mfp Firmware Ls 3640Mfp Firmware Ecosys M2535Dn Firmware Ls 1135Mfp Firmware Ls 1035Mfp Firmware Ls C8650Dn Firmware Ls C8600Dn Firmware Ecosys P6026Cdn Firmware Fs C5250Dn Firmware Ls 4300Dn Firmware Ls 4200Dn Firmware Ls 2100Dn Firmware Ecosys P4040Dn Firmware Ecosys P2135Dn Firmware Fs 1370Dn Firmware

4.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Dec 05, 2022 - 04:15 nvd

MEDIUM 4.8

DescriptionNVD

Stored cross-site scripting vulnerability in Kyocera Document Solutions MFPs and printers allows a remote authenticated attacker with an administrative privilege to inject arbitrary script. Affected products/versions are as follows: TASKalfa 7550ci/6550ci, TASKalfa 5550ci/4550ci/3550ci/3050ci, TASKalfa 255c/205c, TASKalfa 256ci/206ci, ECOSYS M6526cdn/M6526cidn, FS-C2126MFP/C2126MFP+/C2026MFP/C2026MFP+, TASKalfa 8000i/6500i, TASKalfa 5500i/4500i/3500i, TASKalfa 305/255, TASKalfa 306i/256i, LS-3140MFP/3140MFP+/3640MFP, ECOSYS M2535dn, LS-1135MFP/1035MFP, LS-C8650DN/C8600DN, ECOSYS P6026cdn, FS-C5250DN, LS-4300DN/4200DN/2100DN, ECOSYS P4040dn, ECOSYS P2135dn, and FS-1370DN.

AnalysisAI

Stored cross-site scripting vulnerability in Kyocera Document Solutions MFPs and printers allows a remote authenticated attacker with an administrative privilege to inject arbitrary script. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. Stored cross-site scripting vulnerability in Kyocera Document Solutions MFPs and printers allows a remote authenticated attacker with an administrative privilege to inject arbitrary script. Affected products/versions are as follows: TASKalfa 7550ci/6550ci, TASKalfa 5550ci/4550ci/3550ci/3050ci, TASKalfa 255c/205c, TASKalfa 256ci/206ci, ECOSYS M6526cdn/M6526cidn, FS-C2126MFP/C2126MFP+/C2026MFP/C2026MFP+, TASKalfa 8000i/6500i, TASKalfa 5500i/4500i/3500i, TASKalfa 305/255, TASKalfa 306i/256i, LS-3140MFP/3140MFP+/3640MFP, ECOSYS M2535dn, LS-1135MFP/1035MFP, LS-C8650DN/C8600DN, ECOSYS P6026cdn, FS-C5250DN, LS-4300DN/4200DN/2100DN, ECOSYS P4040dn, ECOSYS P2135dn, and FS-1370DN. Affected products include: Kyocera Taskalfa 7550Ci Firmware, Kyocera Taskalfa 6550Ci Firmware, Kyocera Taskalfa 5550Ci Firmware, Kyocera Taskalfa 4550Ci Firmware, Kyocera Taskalfa 3550Ci Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.