High severity · published Apr 4, 2022
CVE-2022-1026
Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, through an…
8.6
CVSS
14.6%
EPSS
No
On KEV
Description
Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, through an insufficiently protected address book export function.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)14.6% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NV
Net Viewer · Kyocera
through 2s0_1000.005.0012s5_2000.002.505 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-1026
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-1026
Vendor Advisory
https://www.kyoceradocumentsolutions.com/en/our-business/security/information/2022-04-04.html
Exploit
https://www.rapid7.com/blog/post/2022/03/29/cve-2022-1026-kyocera-net-view-address-book-exposure/