CVE-2024-12782

Fujifilm Business Innovation Apeos C3070/Apeos C5570/Apeos C6580 Web Interface index.html#hashHome improper authorization

State: Published
Severity: 6.9 Medium
Published: Dec 19, 2024
Updated: Feb 28, 2025
Reserved: Dec 19, 2024

Read the record on cve.org

Description

A vulnerability has been found in Fujifilm Business Innovation Apeos C3070, Apeos C5570 and Apeos C6580 up to 24.8.28 and classified as critical. This vulnerability affects unknown code of the file /home/index.html#hashHome of the component Web Interface. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor explains that "during technical verification it is not possible to reproduce any active actions like reboots which were mentioned in the original researcher disclosure."

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	VulDB
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	VulDB
3.0	7.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P	VulDB

Weaknesses

CWE-285 Improper Authorization
CWE-266 Incorrect Privilege Assignment

Affected Products

Product	Versions
Apeos C3070Fujifilm Business Innovation	22.1.0Affected 22.1.1Affected 22.1.2Affected 22.1.3Affected 22.1.4Affected 22.1.5Affected 22.1.6Affected 22.1.7Affected 22.1.8Affected 22.1.9Affected 22.1.10Affected 22.1.11Affected 22.1.12Affected 22.1.13Affected 22.1.14Affected 22.1.15Affected 22.1.16Affected 22.1.17Affected 22.1.18Affected 22.1.19Affected 22.1.20Affected 22.1.21Affected 22.1.22Affected 22.1.23Affected 22.1.24Affected and 91 more versions
Apeos C5570Fujifilm Business Innovation	22.1.0Affected 22.1.1Affected 22.1.2Affected 22.1.3Affected 22.1.4Affected 22.1.5Affected 22.1.6Affected 22.1.7Affected 22.1.8Affected 22.1.9Affected 22.1.10Affected 22.1.11Affected 22.1.12Affected 22.1.13Affected 22.1.14Affected 22.1.15Affected 22.1.16Affected 22.1.17Affected 22.1.18Affected 22.1.19Affected 22.1.20Affected 22.1.21Affected 22.1.22Affected 22.1.23Affected 22.1.24Affected and 91 more versions
Apeos C6580Fujifilm Business Innovation	22.1.0Affected 22.1.1Affected 22.1.2Affected 22.1.3Affected 22.1.4Affected 22.1.5Affected 22.1.6Affected 22.1.7Affected 22.1.8Affected 22.1.9Affected 22.1.10Affected 22.1.11Affected 22.1.12Affected 22.1.13Affected 22.1.14Affected 22.1.15Affected 22.1.16Affected 22.1.17Affected 22.1.18Affected 22.1.19Affected 22.1.20Affected 22.1.21Affected 22.1.22Affected 22.1.23Affected 22.1.24Affected and 91 more versions

References

VDB-288958 | Fujifilm Business Innovation Apeos C3070/Apeos C5570/Apeos C6580 Web Interface index.html#hashHome improper authorizationvdb-entrytechnical-description
VDB-288958 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #458897 | Fujifilm Business Innovation (China) Co., Ltd. Apeos C3070, Apeos C6580, Apeos C5570 printers Apeos C3070, Apeos C6580, Apeos C5570 unauthorized accessthird-party-advisory
https://www.fujifilm.com/fbglobal/eng/company/news/notice/2024/1226_announce.htmlrelated

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.