CVE-2023-50916 is a high severity flaw in Kyocera Device Manager, scored 7.2. An administrator setting for the database backup location can be pointed at a UNC path, causing NTLM credential exposure. Trustwave recommends upgrading to version 3.1.1213.0 or later, so check the installed version of every server.
What's affected
The record says Kyocera Device Manager before 3.1.1213.0 is affected. The researcher advisory from Trustwave gives a lower threshold: it lists versions prior to 3.0.1625 as affected, and still recommends 3.1.1213.0 as the fixed version. Treat 3.1.1213.0 as the safe target.
There is also an ID mismatch to know about. The record and the Trustwave finding use CVE-2023-50916, while the Kyocera notice link in the record names CVE-2023-50196. Use the version, not the number, when you match your inventory.
NVD scores it 7.2 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. High privileges are required, so this is an authenticated administrator flaw. The Kyocera notice says an attacker must be logged in and on the same network. Trustwave's timeline shows disclosure to the vendor in October 2023 and a patch on 21 December 2023.
How to check if you're exposed
Open Kyocera Device Manager and read its version from the About page. Compare it with 3.1.1213.0. Anything older should be updated, whether or not it sits above the 3.0.1625 threshold.
Check who holds administrator rights in the application, and where the server sits on the network. The flaw needs an authenticated user, so a short list of well protected administrators lowers risk.
Also look at the server's outbound SMB behavior. A device manager that can reach arbitrary file shares can be made to send NTLM authentication, so egress filtering on SMB ports reduces the damage.
What to do now
- Upgrade Kyocera Device Manager to 3.1.1213.0 or later, and contact your Kyocera dealer if you need the installer.
- Limit administrator accounts and require strong credentials.
- Block outbound SMB (TCP 445) from the server to untrusted networks.
- Prefer Kerberos or restrict NTLM where your environment allows.
- Review the configured backup location and confirm it is a local or trusted path.
Why it matters
The weakness is path traversal, CWE-22, here in a form that lets a local path field be replaced with a network path. The GUI rejects the backslash character, but the check lives in the interface and not in the server, so a direct request can set it.
Once the application tries to confirm access to the share, Windows may authenticate with NTLM credentials. The record says this could allow NTLM relaying or cracking attacks, so a configuration setting becomes a way to collect credentials.
The record shows no CISA Known Exploited Vulnerabilities listing, and the fetched pages do not report exploitation in the wild.
Quick check
Why do the sources give different affected versions?
The record says before 3.1.1213.0 and Trustwave says prior to 3.0.1625. Upgrade to 3.1.1213.0 or later to cover both.
Does it need a login?
Yes. The vector requires high privileges and Kyocera says the attacker must be logged in and on the same network.
Sources
Last reviewed: 19 October 2026.
