Kyocera Command Center RX: Plaintext password exposure (CVE-2023-49367)

Kyocera Command Center RX, specifically in the EXOSYS M5521cdn model, is vulnerable to sensitive data exposure (CVE-2023-49367). When a user performs an address book connectivity test for SMB or FTP protocols via the web management interface, the device transmits the configured credentials in plaintext. These credentials can be intercepted by an attacker positioned to monitor network traffic between the printer and the target file server.

Impact

Successful exploitation results in the disclosure of plaintext administrative or service account credentials for SMB/FTP infrastructure, facilitating lateral movement or further unauthorized access to file shares.

Recommendation

• Inventory all Kyocera EXOSYS M5521cdn devices accessible via the internal network.
• Restrict network access to the Command Center RX web management interface to trusted administrative IP addresses only.
• Disable unnecessary SMB/FTP address book functions if not required for standard operations.
• Monitor for unauthorized capture of SMB/FTP traffic originating from printer IP addresses.