CVSS: 6.3EPSS: 0%CPEs: 37EXPL: 0CVE-2024-27974
https://notcve.org/view.php?id=CVE-2024-27974
Cross-site request forgery vulnerability in FUJIFILM printers which implement CentreWare Internet Services or Internet Services allows a remote unauthenticated attacker to alter user information. In the case the user is an administrator, the settings such as the administrator's ID, password, etc. may be altered. As for the details of affected product names, model numbers, and versions, refer to the information provided by the vendor listed under [References]. Vulnerabilidad de Cross-Site Request Forgery en impresoras FUJIFILM que implementan CentreWare Internet Services o Internet Services permite que un atacante remoto no autenticado altere la información del usuario. En el caso de que el usuario sea administrador, se podrán alterar configuraciones como ID de administrador, contraseña, etc. • https://jvn.jp/en/jp/JVN34328023 https://www.fujifilm.com/fbglobal/eng/company/news/notice/2024/0306_1_announce.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.9EPSS: 0%CPEs: 223EXPL: 0CVE-2023-46327
https://notcve.org/view.php?id=CVE-2023-46327
Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp. and Xerox Corporation provide a facility to export the contents of their Address Book with encrypted form, but the encryption strength is insufficient. With the knowledge of the encryption process and the encryption key, the information such as the server credentials may be obtained from the exported Address Book data. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]. Multiple MFPs (Multifunction Printers) proporcionadas por FUJIFILM Business Innovation Corp. y Xerox Corporation brindan la posibilidad de exportar el contenido de su Libreta de Direcciones en forma cifrada, pero la seguridad del cifrado es insuficiente. Conociendo el proceso de cifrado y la clave de cifrado, se puede obtener información como las credenciales del servidor a partir de los datos exportados de la Libreta de Direcciones. • https://jvn.jp/en/vu/JVNVU96482726/index.html https://security.business.xerox.com/en-us/documents/bulletins https://www.fujifilm.com/fbglobal/eng/company/news/notice/2023/1031_addressbook_announce.html • CWE-287: Improper Authentication •
CVSS: 9.1EPSS: 0%CPEs: 183EXPL: 0CVE-2022-26320
https://notcve.org/view.php?id=CVE-2022-26320
The Rambus SafeZone Basic Crypto Module before 10.4.0, as used in certain Fujifilm (formerly Fuji Xerox) devices before 2022-03-01, Canon imagePROGRAF and imageRUNNER devices through 2022-03-14, and potentially many other devices, generates RSA keys that can be broken with Fermat's factorization method. This allows efficient calculation of private RSA keys from the public key of a TLS certificate. Rambus SafeZone Basic Crypto Module anterior a la versión 10.4.0, utilizado en algunos dispositivos Fujifilm (antes Fuji Xerox) anteriores a 2022-03-01, dispositivos Canon imagePROGRAF e imageRUNNER hasta 2022-03-14, y potencialmente muchos otros dispositivos, genera claves RSA que pueden romperse con el método de factorización de Fermat. Esto permite un cálculo eficiente de las claves RSA privadas a partir de la clave pública de un certificado TLS • https://fermatattack.secvuln.info https://global.canon/en/support/security/index.html https://safezoneswupdate.com https://www.fujifilm.com/fbglobal/eng/company/news/notice/2022/0302_rsakey_announce.html https://www.rambus.com/security/response-center/advisories/rmbs-2021-01 https://web.archive.org/web/20220922042721/https://safezoneswupdate.com • CWE-330: Use of Insufficiently Random Values •
CVSS: 4.9EPSS: 0%CPEs: 320EXPL: 1CVE-2021-43774
https://notcve.org/view.php?id=CVE-2021-43774
A risky-algorithm issue was discovered on Fujifilm DocuCentre-VI C4471 1.8 devices. An attacker that obtained access to the administrative web interface of a printer (e.g., by using the default credentials) can download the address book file, which contains the list of users (domain users, FTP users, etc.) stored on the printer, together with their encrypted passwords. The passwords are protected by a weak cipher, such as ROT13, which requires minimal effort to instantly retrieve the original password, giving the attacker a list of valid domain or FTP usernames and passwords. Se ha detectado un problema de algoritmo riesgoso en los dispositivos Fujifilm DocuCentre-VI C4471 versión 1.8. Un atacante que obtuviera acceso a la interfaz web administrativa de una impresora (por ejemplo, usando las credenciales predeterminadas) puede descargar el archivo de la libreta de direcciones, que contiene la lista de usuarios (usuarios de dominio, usuarios de FTP, etc.) almacenados en la impresora, junto con sus contraseñas cifradas. • https://www.foregenix.com/blog https://www.foregenix.com/blogs-new-2021/dude-its-just-a-printer https://www.fujifilm.com/fbglobal/eng/company/news/notice/2022/0302_addressbook_announce.html • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •