SATO CL4/6NX Plus and CL4/6NX-J Plus OS Command Injection Vulnerability

An OS command injection vulnerability has been identified in SATO label printers CL4/6NX Plus and CL4/6NX-J Plus (Japan model) running firmware versions prior to 1.15.5-r1. This vulnerability allows for the execution of arbitrary OS commands on the system with certain non-administrative user privileges.

Impact

Exploitation of this vulnerability allows for the execution of arbitrary OS commands on the affected system, with certain non-administrative user privileges.

Remediation

Users are advised to update the printer firmware to the latest version. For those unable to apply the update, SATO recommends enabling the printer's firewall and disabling the WebConfig function as a temporary workaround.