Skip to main content

    Safety-related information:

    Vulnerability in KX driver (CVE-2023-38634)

    I. Summary of the vulnerability

    Publication:
    24.05.2023

    Description:
    CVE-2023-38634    : The following vulnerability has been identified in KX Driver: Authorization Vulnerability.
    The vulnerability relates to a vulnerability known as Microsoft Windows Unquoted Service Path Enumeration. An executable path vulnerability and the creation of an unquoted service could allow an attacker to execute arbitrary programs (e.g., malware) with Windows system privileges.
    It is possible to revoke Windows system privileges, and it is possible to spy on information that exists under Windows or to perform an attack with system privileges.
    However, the attacker must have access to the target Windows system to do so.
     

    Affected products:
    Software products that are affected by a similar vulnerability:

    • Status Monitor
    • TA Fleetmanager NetGateway
    • Device Manager
    • TA Cloud Print and Scan Desktop client
    • TA Smart Information Manager (TASIM)

    At the time of this publication, we are not aware of any attacks that exploit these vulnerabilities.

    II. Solution description

    As a countermeasure, a new KX Driver web package is available that addresses the vulnerability. We recommend installing the latest driver.

    Release of update versions for the affected products

    KX Driver (incl. Status Monitor)                   published
    TA Fleetmanager NetGateway                     published
    Device Manager                                              published
    TA Cloud Print and Scan                               published
    TA Smart Information Manager (TASIM)   published