CVE-2022-1026: Kyocera Net View Address Book Exposure

Record summary

CVE-2022-1026 has a selected CVSS score of 8.6 (high); EIP currently links 5 repository PoCs and 1 Nuclei template.

Description

Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, through an insufficiently protected address book export function.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV: Listed · Jun 8, 2024 · VulnCheck
Reported exploitation: Observed · VulnCheck

Available material

Repository PoCs: 5
Nuclei templates: 1

Affected products and versions

Product	Source	Version range	Status
Multifunction Printer Net Viewer Browse Kyocera / Multifunction Printer Net Viewer	CVE List	2S0_1000.005.0012S5_2000.002.505 to ≤ 2S0_1000.005.0012S5_2000.002.505	affected
net_viewer Browse kyocera / net_viewer	VulnCheck	Version data not supplied

Proofs of concept

Repository PoCs

GitHubh4po0n/kyocera-cve-2022-1026_SOAP1.1Repository PoCby h4po0n2Exploit4 files

324.1 KiB

GitHub

PoC details

Analysisdeepseek-v4-pro:cloud · 2026-08-11

Technical assessment

A Python script that exploits CVE-2022-1026 on Kyocera printers by sending SOAP 1.1 requests to the address book service to retrieve sensitive user information, including usernames and passwords, without authentication.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a single Python script implementing a proof-of-concept for CVE-2022-1026. The script sends SOAP requests to Kyocera printers to retrieve address book entries, including credentials, and saves the results locally. No backdoor, deceptive payload, or concealed operator-directed harm is observed. The code performs only the documented exploit behavior against the stated target.

ClassificationExploit

Model confidence95%

AuthenticationNot required

LanguagesPython

Target softwareKyocera Net ViewerKyocera multifunction printer SOAP service

Attack typesinformation disclosurecredential extraction

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The script actively retrieves sensitive credentials (usernames and passwords) from a vulnerable Kyocera device by sending crafted SOAP requests, which constitutes exploitation of CVE-2022-1026 rather than mere detection or scanning.

README.md:5getKyoceraCreds_soap1.1.py:1-11getKyoceraCreds_soap1.1.py:145-216

Requirements

Network access to a vulnerable Kyocera printer on port 9091getKyoceraCreds_soap1.1.py:30getKyoceraCreds_soap1.1.py:149

Observed behavior

Sends a SOAP 1.1 request to create a personal address enumeration on the target devicegetKyoceraCreds_soap1.1.py:155-160
Retrieves the personal address list via SOAP, which contains usernames and passwordsgetKyoceraCreds_soap1.1.py:190-198
Parses the retrieved XML response to extract credentials (login_name, payload withheld) for SMB, FTP, and email entriesgetKyoceraCreds_soap1.1.py:238-284
Outputs extracted credentials to the console and a CSV filegetKyoceraCreds_soap1.1.py:325-343

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential Extraction: Payload withheldThe script parses and outputs login passwords from the printer's address book, which is the intended behavior of the CVE-2022-1026 PoC.getKyoceraCreds_soap1.1.py:248getKyoceraCreds_soap1.1.py:264getKyoceraCreds_soap1.1.py:340
Network Communication: Payload withheldThe script communicates with the target Kyocera device over HTTPS on port 9091 to exploit the vulnerability.getKyoceraCreds_soap1.1.py:149
Ssl Verification Disabled: Payload withheldThe script disables SSL certificate verification, which is common in PoC scripts targeting internal devices with self-signed certificates.getKyoceraCreds_soap1.1.py:135

Review boundaries

What the analysis did not establish

Two non-text media files (images) were not analyzed; they are referenced in README.md as screenshots of the web interface and credential output.
The evidence does not include the original PoC repository by ac3lives, only this adapted version.
Two non-text media files (Images/Webinterface.png, Images/Creds.png) were flagged as binary and not analyzed; they are referenced in the README as screenshots and are not expected to contain executable code.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubD4RKMATT3R/KyoceraCredsDumpRepository PoCby D4RKMATT3R7Exploit2 files

22.3 KiB

GitHub

PoC details

Analysisdeepseek-v4-pro:cloud · 2026-08-08

Technical assessment

A Python script that exploits CVE-2022-1026 to extract credentials (SMB, FTP, email) from Kyocera printer address books via unauthenticated SOAP requests. It supports scanning multiple targets (CIDR, ranges, lists) with concurrent workers and outputs extracted usernames and passwords.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python script (KyoceraCredsDump.py) and a README.md. The script implements a multi-target scanner for CVE-2022-1026, extracting credentials from Kyocera printer address books via unauthenticated SOAP requests. No backdoor, trojan, or deceptive behavior is observed. The code performs only the advertised credential extraction and reporting; it contains no persistence mechanisms, unrelated remote access, data exfiltration to third parties, or concealed payloads. All network activity is directed at user-supplied targets. The README provides usage instructions and credits, with no hidden instructions or malicious intent.

ClassificationExploit

Model confidence98%

AuthenticationNot required

Languagespython

Target softwareKyocera Net ViewerKyocera multifunction printers

Attack typescredential extractioninformation disclosure

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends crafted SOAP requests to vulnerable Kyocera printers to extract credentials from the address book without authentication, which constitutes exploitation of CVE-2022-1026. It does not merely detect the vulnerability; it retrieves sensitive data.

KyoceraCredsDump.py:1-6KyoceraCredsDump.py:241-296README.md:1-3

Requirements

Target must be a Kyocera printer with the vulnerable SOAP service running on the specified port (default 9091).KyoceraCredsDump.py:247KyoceraCredsDump.py:446-447
Network connectivity to the target on the specified port.KyoceraCredsDump.py:161-168

Observed behavior

Sends an unauthenticated SOAP request to create an address book enumeration on the target.KyoceraCredsDump.py:250-251KyoceraCredsDump.py:140
Retrieves the address book list using the enumeration ID and parses the XML response for credentials (username, password, host, protocol).KyoceraCredsDump.py:275-276KyoceraCredsDump.py:282KyoceraCredsDump.py:199-238
Outputs extracted credentials in a formatted table, including target IP, protocol, host, username, and password.KyoceraCredsDump.py:325-353KyoceraCredsDump.py:371-427

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Behavior: Payload withheldThe script sends SOAP requests only to the Kyocera service endpoint on targets specified by the user via command-line arguments. No other outbound connections are made.KyoceraCredsDump.py:247-251KyoceraCredsDump.py:275-276
Credential Handling: Payload withheldThe walk_for_creds function collects credentials into a list, which is then formatted and printed by print_summary. No code writes credentials to disk or sends them to any remote server other than the target printer.KyoceraCredsDump.py:199-238KyoceraCredsDump.py:325-427
Code Origin: Payload withheldThe script header and README clearly attribute the original work and describe the modifications. No obfuscation or hidden authorship is present.KyoceraCredsDump.py:8-12README.md:2-4

Review boundaries

What the analysis did not establish

Evidence is limited to the readable text of two files (KyoceraCredsDump.py and README.md) from the repository snapshot. No binary files or network captures are included. The analysis is based solely on static code review; the code was not executed.
Only the two text files (KyoceraCredsDump.py and README.md) were supplied; no other repository files were reviewed.
Binary content was flagged as metadata-only and not analyzed, but no binary files were identified in the artifact.
The review is based solely on static analysis of the provided source code; runtime behavior was not observed.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubac3lives/kyocera-cve-2022-1026Repository PoCby ac3lives24Not analyzed2 files

5.0 KiB

GitHub

PoC details

GitHubflamebarke/nmap-printer-nse-scriptsRepository PoCby flamebarke2Not analyzed2 files

8.3 KiB

GitHub

PoC details

GitHubr0lh/kygoceraRepository PoCby r0lh0Not analyzed3 files

12.8 KiB

GitHub

PoC details

Nuclei templates

ProjectDiscoveryHIGHKyocera Net View Address Book ExposureCVSS 8.6

Impact

Unauthenticated attackers can export the address book from Kyocera printers containing sensitive user information including usernames and passwords without authentication.

Remediation

Apply firmware updates provided by Kyocera or configure authentication for the address book export function.

WeaknessesCWE-522

AuthorsDhiyaneshDK

Template tagscvecve2022kyoceraexposurevkevvuln

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CPE: cpe:2.3:a:kyocera:net_viewer:*:*:*:*:*:*:*:*

Shodan: product:"Kyocera Printer Panel"

https://github.com/ac3lives/kyocera-cve-2022-1026 https://www.rapid7.com/blog/post/2022/03/29/cve-2022-1026-kyocera-net-view-address-book-exposure/

Source: ProjectDiscovery

References

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2022-1026

kyoceradocumentsolutions.comConfirmation

https://www.kyoceradocumentsolutions.com/en/our-business/security/information/2022-04-04.html

rapid7.com

https://www.rapid7.com/blog/post/2022/03/29/cve-2022-1026-kyocera-net-view-address-book-exposure

CVE-2022-1026

Record summary

Description

Exploitation context

Known exploitation

Available material

Affected products and versions

Multifunction Printer Net Viewer

net_viewer

Proofs of concept

Repository PoCs

Technical assessment

Backdoor review

Classification basis

Requirements

Observed behavior

Observables

Technical assessment

Backdoor review

Classification basis

Requirements

Observed behavior

Observables

Nuclei templates

Impact

Remediation

References