Kyocera Device Manager before 3.1.1213.0 allows NTLM credential exposure during UNC path authentication via a crafted change from a local path to a UNC path. It allows administrators to configure the backup location of the database used by the application. Attempting to change this location to a UNC path via the GUI is rejected due to the use of a \ (backslash) character, which is supposed to be disallowed in a pathname. Intercepting and modifying this request via a proxy, or sending the request directly to the application endpoint, allows UNC paths to be set for the backup location. Once such a location is set, Kyocera Device Manager attempts to confirm access and will try to authenticate to the UNC path; depending on the configuration of the environment, this may authenticate to the UNC with Windows NTLM hashes. This could allow NTLM credential relaying or cracking attacks.
References
Link | Resource |
---|---|
https://www.kyoceradocumentsolutions.us/en/about-us/pr-and-award-certifications/press/kyocera-device-manager-cve-2023-50196-vulnerability-solution-update.html | Vendor Advisory |
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/ | Third Party Advisory |
https://www.trustwave.com/hubfs/Web/Library/Advisories_txt/TWSL2024-001_kyocera-v2.txt | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2024-01-10T00:00:00
Updated: 2024-01-10T18:51:05.934292
Reserved: 2023-12-15T00:00:00
Link: CVE-2023-50916
JSON object: View
NVD Information
Status : Analyzed
Published: 2024-01-10T19:15:08.227
Modified: 2024-01-19T17:49:52.770
Link: CVE-2023-50916
JSON object: View
Redhat Information
No data.
CWE