CVE-2023-34259

Kyocera TASKalfa 4053ci 2VG_S000.002.561 Path Traversal / Denial of Service

Severity Score

4.9

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow /wlmdeu%2f%2e%2e%2f%2e%2e directory traversal to read arbitrary files on the filesystem, even files that require root privileges. NOTE: this issue exists because of an incomplete fix for CVE-2020-23575.

Las impresoras Kyocera TASKalfa 4053ci hasta 2VG_S000.002.561 permiten /wlmdeu%2f%2e%2e%2f%2e%2e directory traversal para leer archivos arbitrarios en el sistema de archivos, incluso archivos que requieren privilegios de root. NOTA: este problema existe debido a una solución incompleta para CVE-2020-23575.

Kyocera TASKalfa 4053ci versions 2VG_S000.002.561 and below suffers from path traversal, user enumeration, and denial of service vulnerabilities.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

Multiple

Confidentiality

Complete

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

Poc

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2023-05-31 CVE Reserved
2023-07-11 CVE Published
2023-07-11 First Exploit
2024-09-06 CVE Updated
2025-04-15 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CAPEC

References (3)

URL	Tag	Source
https://sec-consult.com/vulnerability-lab	Third Party Advisory

URL	Date	SRC
https://packetstorm.news/files/id/173397	2023-07-11
https://seclists.org/fulldisclosure/2023/Jul/15	2024-09-06

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Kyocera Search vendor "Kyocera"	D-copia253mf Plus Firmware Search vendor "Kyocera" for product "D-copia253mf Plus Firmware"	<= 2vg_s000.002.561 Search vendor "Kyocera" for product "D-copia253mf Plus Firmware" and version " <= 2vg_s000.002.561"	-	Affected	in	Kyocera Search vendor "Kyocera"	D-copia253mf Plus Search vendor "Kyocera" for product "D-copia253mf Plus"	-	-	Safe