CVE-2023-46327Public exploitNetwork attack vector

Credential disclosure via reversible address-book export encryption

Published Nov 2, 2023 · Updated Sep 6, 2024

Weak encryption in address-book exports from FUJIFILM and Xerox MFP firmware allows attackers to recover stored server credentials. The export interface returns SOAP XML containing JSON entries whose credential cipher uses an easily guessed static key, MD5-derived AES keying, and reversible AES-CBC data. On default configurations, remote attackers can retrieve the export without authentication; exploitation requires stored SMB or FTP credentials.

CVSS severity5.4
Medium
EPSS probability0.35%
Next 30 days · Sep 16, 2026
Known exploitationUnconfirmed
Based on sourced intelligence
Hinoki checkNot available
Coverage for this vulnerability

See if you're affected

Explore vulnerability checks for your environment with Hinoki.

Book a demo

Summary

What happened

Weak encryption in address-book exports from FUJIFILM and Xerox MFP firmware allows attackers to recover stored server credentials. The export interface returns SOAP XML containing JSON entries whose credential cipher uses an easily guessed static key, MD5-derived AES keying, and reversible AES-CBC data. On default configurations, remote attackers can retrieve the export without authentication; exploitation requires stored SMB or FTP credentials.

The record

CVE
CVE-2023-46327
Published
Nov 2, 2023
Updated
Sep 6, 2024
Vendor
FUJIFILM Business Innovation Corp.
Product
Apeos C3060 GK
Classifications
CWE-1391, T1552.001
Attack vector
network
Privileges
unauthenticated

Timeline

How it unfolded

  1. Nov 2, 2023CVE publishedPublication date reported by the CVE source.
  2. Sep 6, 2024Record updatedLatest update available in the CVE record.

Exploitability

Present is not the same as exploitable

Compare your product and version with the public record. A matching version still requires validation against your environment.

Is a vulnerable build present?

Compare these published version ranges with your installed build and any vendor patches.

  1. Affected versionversion=1.0.0 to 1.2.14
  2. Affected versionversion=1.20.0 to 1.26.10

What conditions does exploitation require?

Attack vectornetwork
Required privilegesunauthenticated

What is affected?

FUJIFILM Business Innovation Corp. · Apeos C3060 GKversion=1.0.0 to 1.2.14; version=1.20.0 to 1.26.10
FUJIFILM Business Innovation Corp. · Apeos C7070version=1.0.0 to 1.3.7; version=1.0.0 to 21.26.3; version=1.21.0 to 1.21.8; version=1.21.0 to 1.26.11; version=1.26.0 to 1.26.11
FUJIFILM Business Innovation Corp. · Apeos 4570version=1.0.0 to 1.3.6; version=1.21.0 to 1.21.5; version=1.21.0 to 1.26.9; version=1.26.0 to 1.26.9
FUJIFILM Business Innovation Corp. · ApeosPort C5570version=1.0.0 to 1.60.17
FUJIFILM Business Innovation Corp. · ApeosPort C2360version=1.0.0 to 1.60.15
FUJIFILM Business Innovation Corp. · ApeosPort C2060version=1.0.0 to 1.60.15
FUJIFILM Business Innovation Corp. · ApeosPort C3060version=1.0.0 to 1.60.15
FUJIFILM Business Innovation Corp. · Apeos C8180version=1.0.0 to 1.3.7; version=1.21.0 to 1.21.6; version=1.21.0 to 1.26.12; version=1.26.0 to 1.26.8
FUJIFILM Business Innovation Corp. · Apeos 2560version=1.0.0 to 1.2.16; version=1.20.0 to 1.20.7; version=1.20.0 to 1.26.10; version=1.26.0 to 1.26.10
Xerox · Xerox VersaLink B615version=1.0.0 to 1.93.0
FUJIFILM Business Innovation Corp. · ApeosPort C2060 Gversion=1.0.0 to 1.60.15
FUJIFILM Business Innovation Corp. · ApeosPort 3060version=1.0.0 to 1.60.16
FUJIFILM Business Innovation Corp. · Apeos 3560version=1.0.0 to 1.2.16; version=1.20.0 to 1.26.10
FUJIFILM Business Innovation Corp. · Apeos 5570version=1.0.0 to 1.3.6; version=1.21.0 to 1.26.9
FUJIFILM Business Innovation Corp. · ApeosPro C650version=1.0.0 to 1.3.6; version=1.0.0 to 21.21.5; version=1.21.0 to 1.21.6; version=1.21.0 to 1.26.14; version=1.26.0 to 1.26.8
FUJIFILM Business Innovation Corp. · Apeos C4570version=1.0.0 to 1.3.7; version=1.0.0 to 21.26.3; version=1.21.0 to 1.21.8; version=1.21.0 to 1.26.11; version=1.26.0 to 1.26.11
FUJIFILM Business Innovation Corp. · Apeos 1860version=1.0.0 to 1.2.16; version=1.20.0 to 1.20.7; version=1.26.0 to 1.26.10
FUJIFILM Business Innovation Corp. · ApeosPort C2560version=1.0.0 to 1.60.15
FUJIFILM Business Innovation Corp. · ApeosPort-VII C3322version=1.0.0 to 1.60.15
FUJIFILM Business Innovation Corp. · ApeosPort 2560 Gversion=1.0.0 to 1.60.16
FUJIFILM Business Innovation Corp. · Apeos C4030version=1.0.0 to 1.20.9
FUJIFILM Business Innovation Corp. · ApeosPort C2570version=1.0.0 to 1.60.17
FUJIFILM Business Innovation Corp. · Revoria Press E1125version=1.0.0 to 1.3.5; version=1.0.0 to 21.21.6; version=1.21.0 to 1.21.5; version=1.21.0 to 1.26.11; version=1.26.0 to 1.26.7
FUJIFILM Business Innovation Corp. · ApeosPort C6570version=1.0.0 to 1.60.17
Xerox · Xerox VersaLink B7130version=1.0.0 to 1.94.0
FUJIFILM Business Innovation Corp. · Apeos C2360version=1.0.0 to 1.2.14; version=1.20.0 to 1.20.7; version=1.26.0 to 1.26.10
FUJIFILM Business Innovation Corp. · ApeosPro C810version=1.0.0 to 1.3.6; version=1.0.0 to 21.21.5; version=1.21.0 to 1.21.6; version=1.21.0 to 1.26.14; version=1.26.0 to 1.26.8
FUJIFILM Business Innovation Corp. · Revoria Press E1136version=1.0.0 to 1.3.5; version=1.0.0 to 21.21.6; version=1.21.0 to 1.21.5; version=1.21.0 to 1.26.11; version=1.26.0 to 1.26.7
FUJIFILM Business Innovation Corp. · Apeos 3060 GKversion=1.0.0 to 1.2.16; version=1.20.0 to 1.26.10
Xerox · Xerox PrimeLink C9070version=1.0.0 to 1.4.0
Xerox · Xerox VersaLink C505version=1.0.0 to 1.93.0
FUJIFILM Business Innovation Corp. · ApeosPort C4570version=1.0.0 to 1.60.17
FUJIFILM Business Innovation Corp. · ApeosPort C3070version=1.0.0 to 1.60.17
FUJIFILM Business Innovation Corp. · ApeosPort-VII C4421version=1.0.0 to 1.60.14
FUJIFILM Business Innovation Corp. · Apeos C2560 GKversion=1.0.0 to 1.2.14; version=1.20.0 to 1.26.10
Xerox · Xerox VersaLink B605version=1.0.0 to 1.93.0
Xerox · Xerox PrimeLink B9100version=1.0.0 to 1.4.0
Xerox · Xerox VersaLink C7125version=1.0.0 to 1.94.0
FUJIFILM Business Innovation Corp. · ApeosPort C7070version=1.0.0 to 1.60.17
FUJIFILM Business Innovation Corp. · ApeosPort 4570version=1.0.0 to 1.60.15
FUJIFILM Business Innovation Corp. · Apeos C5570version=1.0.0 to 1.3.7; version=1.0.0 to 21.26.3; version=1.21.0 to 1.21.8; version=1.21.0 to 1.26.11; version=1.26.0 to 1.26.11
FUJIFILM Business Innovation Corp. · ApeosPort 5570version=1.0.0 to 1.60.15
Xerox · Xerox VersaLink C405version=1.0.0 to 1.93.0
FUJIFILM Business Innovation Corp. · Apeos C3070version=1.0.0 to 1.3.7; version=1.0.0 to 21.26.3; version=1.21.0 to 1.21.8; version=1.21.0 to 1.26.11; version=1.26.0 to 1.26.11
FUJIFILM Business Innovation Corp. · Apeos 5330version=1.0.0 to 1.20.8
FUJIFILM Business Innovation Corp. · ApeosPort 5570 Gversion=1.0.0 to 1.60.15
FUJIFILM Business Innovation Corp. · Apeos 3570version=1.0.0 to 1.3.6; version=1.21.0 to 1.21.5; version=1.26.0 to 1.26.9
FUJIFILM Business Innovation Corp. · Apeos C6580version=1.0.0 to 1.3.7; version=1.21.0 to 1.21.6; version=1.21.0 to 1.26.12; version=1.26.0 to 1.26.8
FUJIFILM Business Innovation Corp. · PrimeLink C9070version=1.0.0 to 1.145.3
Xerox · Xerox VersaLink B7035version=1.0.0 to 1.88.0
FUJIFILM Business Innovation Corp. · ApeosPort 1860version=1.0.0 to 1.60.16
Xerox · Xerox VersaLink B7125version=1.0.0 to 1.94.0
Xerox · Xerox VersaLink C7130version=1.0.0 to 1.94.0
Xerox · Xerox PrimeLink B9110version=1.0.0 to 1.4.0
Xerox · Xerox VersaLink C7120version=1.0.0 to 1.94.0
FUJIFILM Business Innovation Corp. · ApeosPort C2560 Gversion=1.0.0 to 1.60.15
FUJIFILM Business Innovation Corp. · Apeos C3060version=1.0.0 to 1.2.14; version=1.20.0 to 1.26.10
FUJIFILM Business Innovation Corp. · Apeos C2570version=1.0.0 to 1.3.7; version=1.21.0 to 1.21.8; version=1.21.0 to 1.26.11; version=1.26.0 to 1.26.11
FUJIFILM Business Innovation Corp. · Apeos 4830version=1.0.0 to 1.20.8
FUJIFILM Business Innovation Corp. · Apeos C2560version=1.0.0 to 1.2.14; version=1.20.0 to 1.26.10
FUJIFILM Business Innovation Corp. · Revoria Press SC180version=1.0.0 to 1.22.7; version=1.0.0 to 21.0.7
Xerox · Xerox PrimeLink B9125version=1.0.0 to 1.4.0
Xerox · Xerox VersaLink B7030version=1.0.0 to 1.88.0
Xerox · Xerox VersaLink B7135version=1.0.0 to 1.94.0
Xerox · Xerox VersaLink B7025version=1.0.0 to 1.88.0
FUJIFILM Business Innovation Corp. · Revoria Press SC170version=1.0.0 to 1.22.7; version=1.0.0 to 21.0.7
FUJIFILM Business Innovation Corp. · ApeosPort-VII C3321version=1.0.0 to 1.60.14
FUJIFILM Business Innovation Corp. · Apeos 5580version=1.20.0 to 1.21.4; version=1.26.0 to 1.26.8
FUJIFILM Business Innovation Corp. · Apeos C3570version=1.0.0 to 1.3.7; version=1.0.0 to 21.26.3; version=1.21.0 to 1.21.8; version=1.21.0 to 1.26.11; version=1.26.0 to 1.26.11
FUJIFILM Business Innovation Corp. · Apeos 6340version=1.0.0 to 1.2.11; version=1.20.0 to 1.20.4; version=1.20.0 to 1.20.5
FUJIFILM Business Innovation Corp. · ApeosPort-VII 4021version=1.0.0 to 1.60.14
Xerox · Xerox PrimeLink B9136version=1.0.0 to 1.4.0
Xerox · Xerox VersaLink C7025version=1.0.0 to 1.88.0
FUJIFILM Business Innovation Corp. · ApeosPort 3570version=1.0.0 to 1.60.15
FUJIFILM Business Innovation Corp. · ApeosPort 3560version=1.0.0 to 1.60.16
FUJIFILM Business Innovation Corp. · Apeos 3560 GKversion=1.0.0 to 1.2.16; version=1.20.0 to 1.26.10
Xerox · Xerox VersaLink C7030version=1.0.0 to 1.88.0
FUJIFILM Business Innovation Corp. · ApeosPort 3060 Gversion=1.0.0 to 1.60.16
FUJIFILM Business Innovation Corp. · ApeosPort C3060 Gversion=1.0.0 to 1.60.15
FUJIFILM Business Innovation Corp. · ApeosPort-VII 5022version=1.0.0 to 1.60.15
FUJIFILM Business Innovation Corp. · Apeos C7580version=1.0.0 to 1.3.7; version=1.21.0 to 1.21.6; version=1.21.0 to 1.26.12; version=1.26.0 to 1.26.8
FUJIFILM Business Innovation Corp. · ApeosPort C3570version=1.0.0 to 1.60.17
FUJIFILM Business Innovation Corp. · Apeos C2060version=1.0.0 to 1.2.14; version=1.20.0 to 1.20.7; version=1.20.0 to 1.26.10; version=1.26.0 to 1.26.10
FUJIFILM Business Innovation Corp. · Revoria Press E1100version=1.0.0 to 1.3.5; version=1.0.0 to 21.21.6; version=1.21.0 to 1.21.5; version=1.21.0 to 1.26.11; version=1.26.0 to 1.26.7
FUJIFILM Business Innovation Corp. · PrimeLink C9065version=1.0.0 to 1.145.3
FUJIFILM Business Innovation Corp. · Apeos 2560 GKversion=1.0.0 to 1.2.16; version=1.20.0 to 1.26.10
Xerox · Xerox VersaLink C605version=1.0.0 to 1.93.0
FUJIFILM Business Innovation Corp. · Apeos C6570version=1.0.0 to 1.3.7; version=1.0.0 to 21.26.3; version=1.21.0 to 1.21.8; version=1.21.0 to 1.26.11; version=1.26.0 to 1.26.11
Xerox · Xerox WorkCentre 6515version=1.0.0 to 1.87.1
FUJIFILM Business Innovation Corp. · ApeosPort 4570 Gversion=1.0.0 to 1.60.15
Xerox · Xerox VersaLink B405version=1.0.0 to 1.93.0
FUJIFILM Business Innovation Corp. · ApeosPro C750version=1.0.0 to 1.3.6; version=1.0.0 to 21.21.5; version=1.21.0 to 1.21.6; version=1.21.0 to 1.26.14; version=1.26.0 to 1.26.8
FUJIFILM Business Innovation Corp. · Apeos C5240version=1.0.0 to 1.2.12; version=1.20.0 to 1.20.5; version=1.20.0 to 1.20.6
FUJIFILM Business Innovation Corp. · ApeosPort 3560 Gversion=1.0.0 to 1.60.16
FUJIFILM Business Innovation Corp. · Revoria Press E1110version=1.0.0 to 1.3.5; version=1.0.0 to 21.21.6; version=1.21.0 to 1.21.5; version=1.21.0 to 1.26.11; version=1.26.0 to 1.26.7
FUJIFILM Business Innovation Corp. · Apeos C2060 GKversion=1.0.0 to 1.2.14; version=1.20.0 to 1.26.10
FUJIFILM Business Innovation Corp. · ApeosPort-VII C4422version=1.0.0 to 1.60.15
Xerox · Xerox VersaLink C7020version=1.0.0 to 1.88.0
FUJIFILM Business Innovation Corp. · ApeosPort 2560version=1.0.0 to 1.60.16
FUJIFILM Business Innovation Corp. · Apeos 7580version=1.0.0 to 1.26.8; version=1.20.0 to 1.21.4; version=1.26.0 to 1.26.8
FUJIFILM Business Innovation Corp. · Apeos 3060version=1.0.0 to 1.2.16; version=1.20.0 to 1.20.7; version=1.20.0 to 1.26.10; version=1.26.0 to 1.26.10
FUJIFILM Business Innovation Corp. · Apeos 6580version=1.0.0 to 1.26.8; version=1.20.0 to 1.21.4; version=1.26.0 to 1.26.8
Xerox · Xerox PrimeLink C9065version=1.0.0 to 1.4.0
FUJIFILM Business Innovation Corp. · ApeosPort-VII 5021version=1.0.0 to 1.60.14
FUJIFILM Business Innovation Corp. · Apeos C3530version=1.0.0 to 1.20.9

Published CVSS scores

5.4Pen Test PartnersCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
5.4JPCERT/CCCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

CVSS describes severity. EPSS estimates exploitation probability.

Attacks

What attackers are doing with it

Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.

Daily unique IPsNo honeypot observations are available for this CVE in the selected window.

No observations available

Sep 10, 2026Sep 16, 2026
Latest reporting daySep 16, 2026
Latest daily unique IPsUnavailable
Prior 30-day averageUnavailable
SourceShadowserver honeypots (KEV)
Vectornetwork
Privilegesunauthenticated
Known exploitationUnconfirmed
Public exploitPublished

Weakness, pattern, technique

CWE-1391Use of Weak Credentials
T1552.001Unsecured Credentials: Credentials In Files

Public exploit references

Labels summarize the accepted research assessment. They do not indicate a test against your environment.

Technologies

Your stack

See the directory against your own environment.

Your stack

Check the software in your environment

Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.

Book a demo