Doxense Watchdoc User Impersonation Vulnerability via Predictable PUK Codes

A vulnerability in Doxense Watchdoc versions prior to 6.1.0.5094 allows for user impersonation through the use of private user PUK codes. This issue arises for Active Directory registered users, as the PUK codes are generated using a predictable algorithm, creating a risk of unauthorized access to user print queues and scanning capabilities.

Impact

Exploitation of this vulnerability could lead to unauthorized user impersonation, allowing an attacker to access and manipulate the print queue and scanning functions of the impersonated user.

Remediation

Users can update to Doxense Watchdoc version 6.1.1 or later. For those on a version prior to 6.0, Doxense no longer provides support, and users should contact their Doxense partner or representative.