Konica Minolta Multifunction Printers and Single-Function Printers.

The overview of the vulnerabilities

Note: Below is the result of risk evaluation assuming that MFP is installed in a general office protected by a firewall.

Affected Models and supported status of the countermeasure firmware
Color, B&W MFPs (Y: Affected, N: Not affected)

Solution

(1) CVE-2021-20870 can be avoided with the standard HDD/SSD encryption feature. Enabling the setting will require formatting and will erase your data, so it is recommended that you back up your important data in advance.

(2) For problems other than the above, the countermeasure firmware will be applied sequentially, either remotely or during a visit by a field technician.

Mitigations

In order to reduce general security risks, including these vulnerabilities, we recommend that you use our devices under various security settings.

• If the administrator password is left at the default setting, change it to a password that is less likely to be guessed.
• In order to reduce the risk of information leakage and unauthorized use due to unauthorized access from outside, please assign a private IP address, use the device in a network protected by a firewall.
• Use the IP address filtering function to limit the range of networks that can access the MFP.

Also, for greater security, consider utilizing the user authentication function to restrict the users of the MFP and not allow public users.
Please refer to the user's guide for detailed settings.

Related information

JVNVU#95192472 Multiple vulnerabilities in KONICA MINOLTA MFPs and printing systems

Acknowledgements

We would like to express gratitude to Prof. Dr. Dominik Merli, Mr. Benjamin Kienle and the team of the Institute for innovative Safety and Security (HSA_innos,hsainnos.de) at Augsburg University of Applied Sciences for finding and reporting the vulnerabilities.

Contact

If you have any questions or need to apply the countermeasure firmware, please contact the service manager of your device.