Konica Minolta Multifunction Printers and Single-Function Printers.

Konica Minolta Multifunction Printers and Single-Function Printers.

WARNING: Multiple Vulnerabilities in Konica Minolta Multifunction Printers and Single-Function Printers.

 

Published: Dec 24, 2021
Konica Minolta, Inc.

Dear Customers,

We deeply appreciate your constant patronage to our products.
Five vulnerabilities have been identified in the affected devices. Here, we report the overview of the problems and our measures for the vulnerabilities.

The overview of the vulnerabilities

Note: Below is the result of risk evaluation assuming that MFP is installed in a general office protected by a firewall.

Reference identification number CVSSv3.1 Base Score Vulnerabilities description
CVE-2021-20868 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N 4.2 If external server authentication is used, a remote attacker with administrative privileges could steal user credentials by sending specific SOAP messages.
CVE-2021-20869 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N 5.3 When using external authentication with an LDAP server, a remote attacker could steal specific authentication information in Administrator settings by sending specific SOAP messages.
CVE-2021-20870 CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N 4.0 When scan transmission is interrupted by a network error, a physically accessible attacker could steal the scanned image data by removing the HDD before the scan job times out.
CVE-2021-20871 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N 5.3 If a scanning destination that requires the registration of authentication information, such as FTP, SMB, or WebDAV, is registered in the address book of a multifunction printer, a remote attacker could steal the registered authentication information by sending a specific SOAP message.
CVE-2021-20872 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H 6.4 An attacker could bypass the tamper detection feature of the firmware and install malicious firmware.



Affected Models and supported status of the countermeasure firmware
Color, B&W MFPs (Y: Affected, N: Not affected)

     
Product name CVE-2021 Affected Version Fixed Version
20868 20869 20870 20871 20872
bizhub C750i Y Y Y Y N G00-35 or earlier G00-E9 or later
bizhub C650i/C550i/C450i Y Y Y Y N G00-B6 or earlier G00-E9 or later
bizhub C360i/C300i/C250i Y Y Y Y N G00-B6 or earlier G00-E9 or later
bizhub 750i/650i/550i/450i Y Y Y Y N G00-37 or earlier G00-E9 or later
bizhub 360i/300i Y Y Y Y N G00-33 or earlier G00-E9 or later
bizhub C287i/C257i/C227i Y Y Y Y N G00-19 or earlier G00-E9 or later
bizhub 306i/266i/246i/226i Y Y Y Y N G00-B6 or earlier G00-E9 or later
bizhub C759/C659 Y Y Y Y Y GC7-X8 or earlier GCA-Y1 or later
bizhub C658/C558/C458
bizhub 958/808/758
bizhub 658e/558e/458e
bizhub C287/C227 Y Y Y Y Y GC7-X8 or earlier GCA-Y0 or later
bizhub 287/227
bizhub 368e/308e Y Y Y Y Y GC7-X8 or earlier GCA-X8 or later
bizhub C368/C308/C258 Y Y Y Y Y GC9-X4 or earlier GCA-X4 or later
bizhub 558/458/368/308
bizhub C754e/C654e Y Y Y Y Y GDQ-M0 or earlier GDR-M0 or later
bizhub 754e/654e
bizhub C554e/C454e Y Y Y Y Y GDQ-M1 or earlier GDR-M1 or later
bizhub C364e/C284e/C224e
bizhub 554e/454e/364e/284e/224e Y Y Y Y Y GDQ-M1 or earlier GDR-M1 or later
bizhub C754/C654, C554/C454 Y Y Y Y Y GR1-M0 or earlier GR4-M0 or later
bizhub C364/C284/C224
bizhub 754/654
bizhub C4050i/C3350i/C4000i/C3300i Y Y Y Y N G00-B6 or earlier G00-E9 or later
bizhub C3320i Y Y Y Y N G00-B6 or earlier G00-E9 or later
bizhub 4750i/4050i Y Y Y Y N G00-22 or earlier G00-E9 or later
bizhub 4700i Y Y Y Y N G00-22 or earlier G00-E9 or later
bizhub C3851FS/C3851/C3351 Y Y Y Y Y GC9-X4 or earlier GCA-X4 or later
bizhub 4752/4052 Y Y Y Y Y GC9-X4 or earlier GCA-X4 or later
bizhub C3850/C3350/3850FS N N Y N N Please see solution (1).
bizhub 4750/4050 N N Y N N Please see solution (1).
bizhub C3110 N N Y N N Please see solution (1).
bizhub C3100P N N Y N N Please see solution (1).

Solution

(1) CVE-2021-20870 can be avoided with the standard HDD/SSD encryption feature. Enabling the setting will require formatting and will erase your data, so it is recommended that you back up your important data in advance.

(2) For problems other than the above, the countermeasure firmware will be applied sequentially, either remotely or during a visit by a field technician.

Mitigations

In order to reduce general security risks, including these vulnerabilities, we recommend that you use our devices under various security settings.

  • If the administrator password is left at the default setting, change it to a password that is less likely to be guessed.
  • In order to reduce the risk of information leakage and unauthorized use due to unauthorized access from outside, please assign a private IP address, use the device in a network protected by a firewall.
  • Use the IP address filtering function to limit the range of networks that can access the MFP.

Also, for greater security, consider utilizing the user authentication function to restrict the users of the MFP and not allow public users.
Please refer to the user's guide for detailed settings.

Related information

JVNVU#95192472 Multiple vulnerabilities in KONICA MINOLTA MFPs and printing systems

Acknowledgements

We would like to express gratitude to Prof. Dr. Dominik Merli, Mr. Benjamin Kienle and the team of the Institute for innovative Safety and Security (HSA_innos,hsainnos.de) at Augsburg University of Applied Sciences for finding and reporting the vulnerabilities.

Contact

If you have any questions or need to apply the countermeasure firmware, please contact the service manager of your device.

Lease To Own & ALL-INCLUSIVE Copier Deals

(15% OFF With Upfront Payment)

$78.29/MONTH NEW DEMO ALL-INCLUSIVE Xerox WorkCentre EC7836 Color Laser Multifunctional Printer Copier Scanner
Sale
Absolute Toner $85/Month BRAND NEW ALL-INCLUSIVE (After Instant Rebate) Xerox WorkCentre EC7836 Color Laser Multifunctional Printer Copier Scanner Showroom Color Copiers

$78.29/MONTH NEW DEMO ALL-INCLUSIVE Xerox WorkCentre EC7836 Color Laser Multifunctional Printer Copier Scanner

Sale price
$3,990
Regular price
$8,500
$98/Month ALL-INCLUSIVE Xerox EC8056 (Demo Unit) 55PPM Color MFP Laser Multifunctional 11X17, 12x18 300 GSM
Sale
Absolute Toner $125/month - ALL-INCLUSIVE Newly Released Xerox® EC8056 IN-STOCK! 55PPM B/W and COLOR MFP Laser Multifunctional Printer Copier Scanner 11X17, 12x18 up to 300 GSM Showroom Color Copiers

$98/Month ALL-INCLUSIVE Xerox EC8056 (Demo Unit) 55PPM Color MFP Laser Multifunctional 11X17, 12x18 300 GSM

Sale price
$4,990
Regular price
$9,500
$75/Month - Ricoh MP C4504EX 45PPM Colour Multifunction Office Laser Printer Copier Scanner up to 180 IPM, 11x17, 12x18, 300gsm, One-Pass-Duplex
Sale
Absolute Toner $75/month - Ricoh MP C4504 45PPM Colour Multifunction Office Laser Printer Copier Scanner, 11x17, 12x18, 300gsm, One-Pass Duplex, 180ipm Lease 2 Own Copiers

$75/Month - Ricoh MP C4504EX 45PPM Colour Multifunction Office Laser Printer Copier Scanner up to 180 IPM, 11x17, 12x18, 300gsm, One-Pass-Duplex

Sale price
$75
Regular price
$95
$29/Month Ricoh MP C300 Series Color Laser Multifunction Printer Copier Scanner With Large LCD Touch Screen
Sale
Absolute Toner From $34/Month ALL-INCLUSIVE Ricoh MP C300 Series Color Laser Multifunction Printer Copier Scanner With Large LCD Touch Screen Showroom Color Copiers

$29/Month Ricoh MP C300 Series Color Laser Multifunction Printer Copier Scanner With Large LCD Touch Screen

Sale price
$29
Regular price
$39.99
$75/Month - ALL INCLUSIVE PROGRAM - Ricoh High Speed Full Size Color Laser Multifunction Printer Copier Scanner 11X17, 12x18, 300GSM
Sale
Absolute Toner $75/Month - ALL INCLUSIVE PROGRAM - Ricoh High Speed Full Size Color Laser Multifunction Printer Copier Scanner 11X17, 12x18, 300GSM Printers/Copiers

$75/Month - ALL INCLUSIVE PROGRAM - Ricoh High Speed Full Size Color Laser Multifunction Printer Copier Scanner 11X17, 12x18, 300GSM

Sale price
$75
Regular price
$85
$49/Month ALL-INCLUSIVE LEASE TO OWN Ricoh MP C3503 Color Multifunction Laser Printer Copier Scanner (11X17, 12x18)
Absolute Toner Ricoh MP C3003 Color Laser Multifunction Printer Copier Scanner (11X17, 12x18) For Office - $39.99/Month Showroom Color Copiers

$49/Month ALL-INCLUSIVE LEASE TO OWN Ricoh MP C3503 Color Multifunction Laser Printer Copier Scanner (11X17, 12x18)

Price
$49
$39/Month Ricoh Copier MP C2503 With High Colour Quality Multifunction Printer Copier 25PPM
Sale
Absolute Toner $47/Month Ricoh Copier MP C2503 With High Colour Quality Multifunction Printer Copier 25PPM Printers/Copiers

$39/Month Ricoh Copier MP C2503 With High Colour Quality Multifunction Printer Copier 25PPM

Sale price
$1,950
Regular price
$2,500
$45Month Xerox Repossessed VersaLink C7020 Color Laser Multifunctional Copier Printer Scanner, Scan 2 email 11x17 For Business
Sale
Absolute Toner Xerox VersaLink C7020 Color Laser Multifunctional Copier Printer Scanner, Scan 2 email 11x17 For Business - $45/Month Showroom Color Copiers

$45Month Xerox Repossessed VersaLink C7020 Color Laser Multifunctional Copier Printer Scanner, Scan 2 email 11x17 For Business

Sale price
$2,290
Regular price
$4,500
$59/Month Canon imageRUNNER ADVANCE C5535i Laser Color Multifunction Printer, Copier, Scanner, 12 x 18 For Office | IRAC5535i
Sale
Absolute Toner $59/Month Canon imageRUNNER ADVANCE C5535i Laser Color Multifunction Printer, Copier, Scanner, 12 x 18 For Office | IRAC5535i Showroom Color Copiers

$59/Month Canon imageRUNNER ADVANCE C5535i Laser Color Multifunction Printer, Copier, Scanner, 12 x 18 For Office | IRAC5535i

Sale price
$2,950
Regular price
$4,500
Xerox COLOR C60 Multifunctional Laser Production Printer Copier
Absolute Toner $146/Month Xerox  COLOR C60 PRO with Capability to print on specialty media -Multifunctional Laser Production Printer Copier Showroom Color Copiers

Xerox COLOR C60 Multifunctional Laser Production Printer Copier

Sale price
$169
Regular price
$265
Xerox Repo VersaLink B405DNI WI-FI B/W Monochrome Multifunction Laser Printer Copier Scanner (B405DN B405)
Sale
Absolute Toner From $17/month-Xerox VersaLink B405DNM B/W Monochrome Multifunction Laser Printer Copier Scanner (B405DN B405) Showroom Monochrome Copiers

Xerox Repo VersaLink B405DNI WI-FI B/W Monochrome Multifunction Laser Printer Copier Scanner (B405DN B405)

Sale price
$795
Regular price
$1,195
From $35/Month Xerox Versalink C405DNI WI-FI (C405) Color Multifunction Laser Printer Copier Scanner, LCD Touch Screen
Sale
Absolute Toner NEW REPO Xerox Versalink C405DNM Color Multifunction Laser Printer Copier Scanner, LCD Touch Screen For Business Showroom Color Copiers

From $35/Month Xerox Versalink C405DNI WI-FI (C405) Color Multifunction Laser Printer Copier Scanner, LCD Touch Screen

Sale price
$35
Regular price
$45
$35/Month (Available with Toner Included Maintenance program) Xerox Versalink C405DNM C405 C405DN Color Laser Multifunction Printer Scanner
Sale
Absolute Toner Xerox Versalink C405dn C405-M All-in-one Color Laser Multifunction Printer Office Copier Scanner Laser Printer

$35/Month (Available with Toner Included Maintenance program) Xerox Versalink C405DNM C405 C405DN Color Laser Multifunction Printer Scanner

Sale price
$35
Regular price
$44
REPOSSESSED Xerox Versalink B405DN Multifunction Digital Laser Printer SCAN 2 EMAIL Office Copier Scanner
Sale
Absolute Toner $25/month. New Repo Xerox Versalink B405 Monochrome Multifunction  Printer Office Copier Scanner only 4K pages printed Laser Printer

REPOSSESSED Xerox Versalink B405DN Multifunction Digital Laser Printer SCAN 2 EMAIL Office Copier Scanner

Sale price
$695
Regular price
$1,199
$75/month Xerox for Printing Invitation, Envelope Printing and PostCards - C8000DT C8000/DT VersaLink Tabloid A3 11x17 (Also available with White Toner)
Sale
Absolute Toner Xerox VersaLink C8000 Color Laser Printer for Professional Results Showroom Color Copiers

$75/month Xerox for Printing Invitation, Envelope Printing and PostCards - C8000DT C8000/DT VersaLink Tabloid A3 11x17 (Also available with White Toner)

Sale price
$4,650
Regular price
$8,950
$249/Month Roland TrueVIS SG-540 54" Eco-Solvent Large Format Printer and Cutter (Print and Cut)
Sale
Absolute Toner Copy of $245/Month Roland TrueVIS SG2-540 54" Eco-Solvent Large Format Inkjet Printer and Cutter (Print and Cut) Print and Cut Plotters

$249/Month Roland TrueVIS SG-540 54" Eco-Solvent Large Format Printer and Cutter (Print and Cut)

Sale price
$249
Regular price
$349
Xerox C60 Production Color Multifunctional Laser Printer Copier Scanner For Business | Production Printer
Absolute Toner $125/Month Xerox C60 Production Color Multifunctional Laser Printer Copier Scanner For Business | Production Printer Showroom Color Copiers

Xerox C60 Production Color Multifunctional Laser Printer Copier Scanner For Business | Production Printer

Price
$117
$75/MONTH COLOR LASER + WHITE TONER PRINTER - XEROX VersaLink C8000W/ DT WHITE TONER and Color (C/M/Y)
Sale
Absolute Toner XEROX VersaLink C8000W/DT WHITE TONER and Color (C/M/Y) Laser Printer. Showroom Color Copiers

$75/MONTH COLOR LASER + WHITE TONER PRINTER - XEROX VersaLink C8000W/ DT WHITE TONER and Color (C/M/Y)

Sale price
$75
Regular price
$134
$45/month Samsung MultiXpress SL-X7400LX Color Laser Multifunction Printer Copier Scanner 11x17
Sale
Absolute Toner $45/month Samsung MultiXpress SL-X7400LX Color Laser Multifunction Printer Copier Scanner 11x17 Printers/Copiers

$45/month Samsung MultiXpress SL-X7400LX Color Laser Multifunction Printer Copier Scanner 11x17

Sale price
$45
Regular price
$75
$150/month KIP 850 Laser FULL COLOR Large Format Printer (Wide Format Colour Laser Printer)
Absolute Toner $185/Month KIP 850 Laser FULL COLOR Wide Format Printer (Large Format Colour Laser Printer) Large Format Printers

$150/month KIP 850 Laser FULL COLOR Large Format Printer (Wide Format Colour Laser Printer)

Sale price
$7,900
Regular price
$34,000