An unauthenticated XML External Entity injection vulnerability in KYOCERA Net Admin 3.4.0906 exposes sensitive system configuration files to remote attackers.

This is an XML External Entity (XXE) injection vulnerability (CWE-611) within the Multi-Set Template Editor component. An unauthenticated attacker can supply a malicious XML template file to the application, which is then parsed insecurely, allowing for the exfiltration of sensitive server files via out-of-band requests.

The ability for an unauthenticated attacker to read arbitrary files poses a severe risk to organizational security. Successful exploitation grants access to sensitive information, such as database credentials, which can lead to complete compromise of the backend database, unauthorized data access, and potential lateral movement within the network. While the CVSS score of 7.5 reflects a High severity, the impact is significant due to the potential for full credential theft.

Immediate Action: Since no specific patch version is provided, administrators should restrict access to the Net Admin web interface to trusted internal networks only. If the Multi-Set Template Editor functionality is not required, disable or remove the component entirely to eliminate the attack surface.

Proactive Monitoring: Monitor network traffic for unusual outbound HTTP requests originating from the Net Admin server, particularly those directed at unknown or external IP addresses, which may indicate an out-of-band data exfiltration attempt.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malformed XML input or DTD (Document Type Definition) references to mitigate the risk of XXE injection.

Public Exploit Available: Yes, a functional exploit proof-of-concept exists as documented in the Exploit-DB entry 44430.

Given the availability of a public exploit and the high potential for credential theft, this vulnerability must be treated with high priority. Organizations using KYOCERA Net Admin 3.4.0906 should immediately restrict access to the application and review vendor channels for any available security updates. Failure to secure this interface may result in unauthorized access to sensitive internal configuration data.