Jim Rush

A path traversal issue exists in the web management interface of several multifunction devices and printers. This occurs due to improper handling of externally supplied parameters, which can be exploited by sending a specially crafted malicious request to trigger unintended processing. Approximately 22,600 instances have been identified globally.

The issue allows attackers to access sensitive information in the "/facade" directory.

The issue allows attackers to execute arbitrary code via uploading a crafted .cfm file to the /fileupload/upload.cfm endpoint.

The issue allows for unauthenticated arbitrary file read.

The issue allows for unauthenticated file upload, resulting in Remote Code Execution (RCE).

The issue is related to SQL Injection. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.