CVE-2022-50932
HighSummary
Kyocera Command Center RX on ECOSYS M2035dn devices contains a directory traversal vulnerability that allows unauthenticated attackers to read sensitive system files by manipulating file paths under the /js/ path. Attackers can exploit the issue by sending requests like /js/../../../../.../etc/passwd%00.jpg to access critical files such as /etc/passwd and /etc/shadow.
Risk Assessment
The risk to the organization includes unauthorized access to confidential system data, which may lead to disclosure of passwords and other sensitive information, potentially resulting in privilege escalation or device compromise.
Recommendation
It is recommended to immediately update the device firmware to the latest version that addresses this vulnerability. Additionally, restrict access to the device management interface to trusted networks only.
Other vulnerabilities in Kyocera Command Center RX
See all- CVE-2025-63579High
A vulnerability in Kyocera Command Center RX allows unauthorized export of the entire address book and bypass of data encryption, leading to disclosure of passwords and other sensitive information. The flaw affects multiple Kyocera TASKalfa printer models.
- CVE-2023-49367High
A vulnerability in the user interface of Kyocera Command Center RX EXOSYS M5521cdn allows a remote attacker to obtain sensitive information by inspecting packets sent by the user.
Original NVD description (English source)
Kyocera Command Center RX ECOSYS M2035dn contains a directory traversal vulnerability that allows unauthenticated attackers to read sensitive system files by manipulating file paths under the /js/ path. Attackers can exploit the issue by sending requests like /js/../../../../.../etc/passwd%00.jpg (null-byte appended traversal) to access critical files such as /etc/passwd and /etc/shadow.