Safety-relevant information:

Publication:
May 24, 2023

Description:
CVE-2023-38634: The following vulnerability has been identified in the KX Driver: Authorization Vulnerability.
The vulnerability relates to a vulnerability known as Microsoft Windows Unquoted Service Path Enumeration. A vulnerability in the executable path and the creation of an unquoted service may allow an attacker to execute arbitrary programs (e.g. malware) with Windows system privileges.
It is possible to revoke Windows system privileges and it is possible to spy on information that exists under Windows or to carry out an attack with system privileges.
To do this, the attacker must have access to the target Windows system.

Products affected:
Software products affected by a similar vulnerability:

At the time of this publication, we are not aware of any attacks that exploit these vulnerabilities.

As a countermeasure, a new KX Driver web package is available that addresses the vulnerability. We recommend installing the latest driver.

Release of update versions for the affected products.
KX Treiber (incl. Status Monitor)                released
TA Fleetmanager NetGateway                    released
Device Manager                                                released
TA Cloud Print and Scan                                released
TA Smart Information Manager (TASIM)   released

The KX v8.4 driver was released on March 14, 2024. Since the vulnerability was announced, new models have been released that contain the KX driver in a version lower than 8.4. The following models have had this vulnerability patch applied from the first release.