Medium severity · published Mar 3, 2022
CVE-2021-43774
A risky-algorithm issue was discovered on Fujifilm DocuCentre-VI C4471 1.8 devices
4.9
CVSS
0.7%
EPSS
No
On KEV
Description
A risky-algorithm issue was discovered on Fujifilm DocuCentre-VI C4471 1.8 devices. An attacker that obtained access to the administrative web interface of a printer (e.g., by using the default credentials) can download the address book file, which contains the list of users (domain users, FTP users, etc.) stored on the printer, together with their encrypted passwords. The passwords are protected by a weak cipher, such as ROT13, which requires minimal effort to instantly retrieve the original password, giving the attacker a list of valid domain or FTP usernames and passwords.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
A2
Apeosport-iv 2060 Firmware · Fujifilm
before 1.160.5 · source: NVD
A3
Apeosport-iv 3060 Firmware · Fujifilm
before 1.160.5 · source: NVD
A3
Apeosport-iv 3065 Firmware · Fujifilm
before 1.160.5 · source: NVD
A3
Apeosport-iv 3070 Firmware · Fujifilm
before 1.140.5 · source: NVD
A4
Apeosport-iv 4070 Firmware · Fujifilm
before 1.140.5 · source: NVD
A5
Apeosport-iv 5070 Firmware · Fujifilm
before 1.140.5 · source: NVD
A5
Apeosport-iv 5080 Firmware · Fujifilm
All versions, or not specified · source: NVD
A6
Apeosport-iv 6080 Firmware · Fujifilm
All versions, or not specified · source: NVD
A7
Apeosport-iv 7080 Firmware · Fujifilm
All versions, or not specified · source: NVD
AC
Apeosport-iv C2270 Firmware · Fujifilm
All versions, or not specified · source: NVD
AC
Apeosport-iv C2275 Firmware · Fujifilm
All versions, or not specified · source: NVD
AC
Apeosport-iv C3370 Firmware · Fujifilm
All versions, or not specified · source: NVD