Publication:
24.05.2023

Description:
CVE-2023-38634: The following vulnerability has been identified in KX Driver: Authorization Vulnerability.
The vulnerability relates to a vulnerability known as Microsoft Windows Unquoted Service Path Enumeration. An executable path vulnerability and the creation of an unquoted service could allow an attacker to execute arbitrary programs (e.g., malware) with Windows system privileges.
It is possible to revoke Windows system privileges, and it is possible to spy on information that exists under Windows or to perform an attack with system privileges.
However, the attacker must have access to the target Windows system to do so.
 

Affected products:
Software products that are affected by a similar vulnerability:

At the time of this publication, we are not aware of any attacks that exploit these vulnerabilities.

As a countermeasure, a new KX Driver web package is available that addresses the vulnerability. We recommend installing the latest driver.

Release of update versions for the affected products

KX Driver (incl. Status Monitor)                   published
TA Fleetmanager NetGateway                     published
Device Manager                                              published
TA Cloud Print and Scan                               published
TA Smart Information Manager (TASIM)   published

The KX v8.4 driver was released on March 14, 2024. Since the vulnerability was announced, new models have been released that contain the KX driver in a version lower than 8.4. The following models have had this vulnerability patch applied from the first release.