Headline
CVE-2023-4957: Authentication Bypass Zebra Ztc | INCIBE-CERT
A vulnerability of authentication bypass has been found on a Zebra Technologies ZTC ZT410-203dpi ZPL printer. This vulnerability allows an attacker that is in the same network as the printer, to change the username and password for the Web Page by sending a specially crafted POST request to the setvarsResults.cgi file. For this vulnerability to be exploitable, the printers protected mode must be disabled.
Description
INCIBE has coordinated the publication of 1 vulnerability that affects Zebra Technologies ZT410-203dpi ZPL printer, which has been discovered by David Cámara Galindo.
This vulnerability has been assigned the following code, CVSS v3.1 base score, CVSS vector string, and CWE vulnerability type:
- CVE-2023-4957: CVSS v3.1: 5.4 | CVSS: AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | CWE-288.
Solution
Zebra Printers running Link-OS v6.0 and later have a protected mode that protects the printer from this vulnerability. Activating this mode disables unauthorized changes and locks the current configuration until an administrator authorizes updates. By default, the secure mode is disabled as it is necessary to generate a password first.
NOTE: the ZT410 industrial printer was discontinued on Oct 1st, 2020. The service and Support discontinuation dates are in September and December 2025 depending on region. Further information regarding security settings and best practices, including “Protected Mode”, can be found in the references.