Alert: New Vulnerabilities Discovered in QNAP and Kyocera Device Manager

We Keep you Connected

Alert: New Vulnerabilities Discovered in QNAP and Kyocera Device Manager

A security flaw has been disclosed in Kyocera’s Device Manager product that could be exploited by bad actors to carry out malicious activities on affected systems.
“This vulnerability allows attackers to coerce authentication attempts to their own resources, such as a malicious SMB share, to capture or relay Active Directory hashed credentials if the ‘Restrict NTLM: Outgoing NTLM traffic to remote servers’ security policy is not enabled,” Trustwave said.
Tracked as CVE-2023-50916, Kyocera, in an advisory released late last month, described it as a path traversal issue that enables an attacker to intercept and alter a local path pointing to the backup location of the database to a universal naming convention (UNC) path.
This, in turn, causes the web application to attempt to authenticate the rogue UNC path, resulting in unauthorized access to clients’ accounts and data theft. Furthermore, depending on the configuration of the environment, it could be exploited to pull off NTLM relay attacks.
The shortcoming has been addressed in Kyocera Device Manager version 3.1.1213.0.
The development comes as QNAP released fixes for several flaws, including high-severity vulnerabilities impacting QTS and QuTS hero, QuMagie, Netatalk and Video Station.
This comprises CVE-2023-39296, a prototype pollution vulnerability that could allow remote attackers to “override existing attributes with ones that have an incompatible type, which may cause the system to crash.”
The shortcoming has been addressed in versions QTS 5.1.3.2578 build 20231110 and QuTS hero h5.1.3.2578 build 20231110.
A brief description of the other notable flaws is as follows –
While there is no evidence that the flaws have been exploited in the wild, it’s recommended that users take steps to update their installations to the latest version to mitigate potential risks.
Report: Unveiling the Threat of Malicious Browser Extensions
Download the Report to learn the Risks of Malicious Extensions and How to Mitigate Them.
Firewalls vs. Zero Trust: Minimize Your Attack Surface
Learn latest trends in the attack landscape, attacker strategies, and how to implement Zero Trust Security.
Key findings from a study of 493 companies: what worked, what didn’t. Apply insights to your SaaS strategy in 2024.
Firewalls & VPNs can’t keep up. Discover how Zero Trust minimizes risks. Join our webinar with Zscaler & revolutionize your security strategy.
Sign up for free and start receiving your daily dose of cybersecurity news, insights and tips.

source

GET THE LATEST UPDATES, OFFERS, INFORMATION & MORE