Executive brief
TA/UTAX Mobile Print is a mobile application used to connect smartphones and tablets to office multi-function printers for scanning and printing documents. A security vulnerability in the app's file import process allows a malicious application on the same device to overwrite the app's internal configuration or system files. This could lead to the app malfunctioning, the theft of sensitive information, or the execution of unauthorized commands on the mobile device.
Technical details
A path traversal vulnerability (CWE-22) exists in the TA/UTAX Mobile Print Android application (com.kyocera.kyoprinttautax) within the file import component. The vulnerability stems from insufficient validation of filenames and paths during the file import process. A malicious application installed on the same device can supply a specially crafted filename containing traversal sequences (e.g., ../) to overwrite files in the application's internal storage. Successful exploitation can lead to arbitrary code execution if executable files or critical configurations are replaced, or information exposure if sensitive data is exfiltrated. The attack requires no complex user interaction beyond the victim opening the malicious application.
Affected products
- TA Triumph-Adler Mobile Print 3.7.2.251001
- UTAX Mobile Print 3.7.2.251001
Timeline
- 2026-03-31: disclosed: Initial disclosure via GitHub and NVD
- 2026-03-31: advisory