Alert: New Vulnerabilities Discovered in QNAP and Kyocera Device Manager

A security flaw has been disclosed in Kyocera’s System Manager product or service that could be exploited by poor actors to have out malicious things to do on influenced programs.

“This vulnerability enables attackers to coerce authentication makes an attempt to their have assets, such as a destructive SMB share, to seize or relay Energetic Listing hashed credentials if the ‘Restrict NTLM: Outgoing NTLM traffic to remote servers’ security policy is not enabled,” Trustwave reported.

Tracked as CVE-2023-50916, Kyocera, in an advisory launched late very last thirty day period, explained it as a route traversal issue that permits an attacker to intercept and alter a area path pointing to the backup area of the databases to a common naming conference (UNC) route.

This, in switch, brings about the web software to endeavor to authenticate the rogue UNC path, resulting in unauthorized access to clients’ accounts and facts theft. Furthermore, relying on the configuration of the ecosystem, it could be exploited to pull off NTLM relay attacks.

The shortcoming has been dealt with in Kyocera Machine Supervisor variation 3.1.1213..

QNAP Releases Fixes for Quite a few Flaws

The growth will come as QNAP introduced fixes for numerous flaws, which include large-severity vulnerabilities impacting QTS and QuTS hero, QuMagie, Netatalk and Video clip Station.

This comprises CVE-2023-39296, a prototype air pollution vulnerability that could let remote attackers to “override existing characteristics with types that have an incompatible type, which could trigger the process to crash.”

The shortcoming has been resolved in variations QTS 5.1.3.2578 make 20231110 and QuTS hero h5.1.3.2578 construct 20231110.

A transient description of the other noteworthy flaws is as follows –

• CVE-2023-47559 – A cross-web page scripting (XSS) vulnerability in QuMagie that could allow authenticated people to inject malicious code through a network (Addressed in QuMagie 2.2.1 and later on)
• CVE-2023-47560 – An running process command injection vulnerability in QuMagie that could let authenticated people to execute commands by means of a network (Tackled in QuMagie 2.2.1 and afterwards)
• CVE-2023-41287 – An SQL injection vulnerability in Video clip Station that could make it possible for buyers to inject malicious code through a network (Addressed in Movie Station 5.7.2 and later on)
• CVE-2023-41288 – An operating program command injection vulnerability in Online video Station that could permit customers to execute commands via a network (Tackled in Video clip Station 5.7.2 and later on)
• CVE-2022-43634 – An unauthenticated distant code execution vulnerability in Netatalk that could enable attackers to execute arbitrary code (Resolved in QTS 5.1.3.2578 establish 20231110 and QuTS hero h5.1.3.2578 build 20231110)

Even though there is no proof that the flaws have been exploited in the wild, it is suggested that people consider steps to update their installations to the latest model to mitigate opportunity risks.

Observed this posting exciting? Comply with us on Twitter  and LinkedIn to browse far more exclusive content we write-up.

Some parts of this article are sourced from:
thehackernews.com