CVE-2022-23862
📋 TL;DR
This vulnerability allows local attackers to escalate privileges to SYSTEM level on Y Soft SAFEQ 6 servers. The JMX service on port 9696 lacks authentication and runs with high privileges, enabling arbitrary code execution. Organizations using Y Soft SAFEQ 6 Build 53 are affected.
💻 Affected Systems
- Y Soft SAFEQ
📦 What is this software?
Safeq by Ysoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, enabling installation of persistent malware, credential theft, and lateral movement across the network.
Likely Case
Local privilege escalation leading to full control of the SAFEQ server, potentially compromising print management infrastructure and connected systems.
If Mitigated
Limited impact with proper network segmentation and access controls preventing unauthorized access to port 9696.
🎯 Exploit Status
Public exploit code exists and exploitation is straightforward once network access to port 9696 is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 6 Build 54 or later
Vendor Advisory: https://ysoft.com
Restart Required: Yes
Instructions:
1. Download the latest SAFEQ version from Y Soft. 2. Install the update following vendor instructions. 3. Restart the SAFEQ service. 4. Verify the JMX service now requires authentication.
🔧 Temporary Workarounds
Block JMX Port
windowsBlock access to port 9696 using firewall rules to prevent exploitation.
netsh advfirewall firewall add rule name="Block SAFEQ JMX" dir=in action=block protocol=TCP localport=9696
Disable JMX Service
windowsDisable the vulnerable JMX service if not required for operations.
sc stop "SafeQ JMX Service"
sc config "SafeQ JMX Service" start= disabled
🧯 If You Can't Patch
- Implement strict network segmentation to isolate SAFEQ servers from untrusted networks.
- Apply principle of least privilege and monitor for unauthorized access attempts to port 9696.
🔍 How to Verify
Check if Vulnerable:
Check if port 9696 is listening and accessible without authentication using telnet or nmap: nmap -p 9696 <server_ip>Check Version:
Check SAFEQ version in the application interface or installation directory properties.Verify Fix Applied:
Verify port 9696 requires authentication or is no longer accessible, and confirm SAFEQ version is Build 54 or later.📡 Detection & Monitoring
Log Indicators:
- Unusual connections to port 9696
- JMX service authentication failures
- Process creation with SYSTEM privileges from unexpected sources
Network Indicators:
- Traffic to port 9696 from unauthorized IPs
- JMX MLet requests in network traffic
SIEM Query:
source_port=9696 OR dest_port=9696 | stats count by src_ip, dest_ip