Konicaminolta Bizhub 367 Firmware vulnerabilities

3 CVEs affecting Konicaminolta Bizhub 367 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-29588, published 2022-05-16.

More from Konicaminolta.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-29588, published 2022-05-16. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. Konica Minolta bizhub MFP devices before 2022-04-14 use cleartext password storage for the /var/log/nginx/html/ADMINPASS and /etc/shadow files.
• CVE-2022-29586, published 2022-05-16. High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days. Konica Minolta bizhub MFP devices before 2022-04-14 allow a Sandbox Escape. An attacker must attach a keyboard to a USB port, press F12, and then escape from the kiosk mode.
• CVE-2022-29587, published 2022-05-16. Medium severity, CVSS 4.0. EPSS: 0.4% chance of exploitation in the next 30 days. Konica Minolta bizhub MFP devices before 2022-04-14 have an internal Chromium browser that executes with root (aka superuser) access privileges.