Security readout for executives and security teams
Plain-English summary
This issue affects p910nd on Inteno IOPSYS 2.0 through 4.2.0. If TCP port 9100 is reachable, a remote attacker may read or append data to arbitrary files. That can expose sensitive device data or alter files, but the bundle does not identify active exploitation or a vendor patch.
Executive priority
Prioritize exposed devices because the issue can affect arbitrary files remotely and public exploit material is referenced. Urgency is highest for internet-facing TCP/9100. If exposure is internal-only and segmented, handle through normal remediation tracking with clear compensating controls.
Technical view
CVE-2018-10123 is an arbitrary file read/append flaw in p910nd on Inteno IOPSYS versions 2.0 through 4.2.0, reachable through requests to TCP/9100. The source bundle provides no CVSS, CWE, authentication detail, or fixed version. Exploit-DB is referenced, indicating public exploit material exists.
Likely exposure
Exposure is most likely on Inteno IOPSYS 2.0 through 4.2.0 systems running p910nd with TCP/9100 reachable from untrusted networks. Internet-facing or broadly reachable management and printer-service networks carry the highest concern.
Exploitation context
The bundle includes an Exploit-DB reference, so public exploit information exists. CISA KEV is false in the bundle, and no cited source states active exploitation. Treat this as credible public-exploit risk, not confirmed in-the-wild exploitation.
Researcher notes
The supplied record is sparse: no CVSS, CWE, authentication requirement, affected CPE, or fixed version is provided. Avoid assuming product lines beyond Inteno IOPSYS. Validation should focus on version, p910nd presence, and TCP/9100 reachability.
Mitigation direction
- Identify Inteno IOPSYS assets running versions 2.0 through 4.2.0.
- Block TCP/9100 from the internet and untrusted networks.
- Disable p910nd or printer service where it is not required.
- Check Inteno or IOPSYS guidance for supported firmware updates or fixes.
- Segment affected devices away from sensitive internal systems.
Validation and detection
- Inventory devices and firmware versions against IOPSYS 2.0 through 4.2.0.
- Confirm whether p910nd is enabled on affected devices.
- Verify TCP/9100 is not reachable from untrusted networks.
- Review logs or network telemetry for unexpected TCP/9100 access.
- Document any compensating controls where patch status is unknown.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-10123 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://neonsea.uk/blog/2018/04/15/pwn910nd.htmlCVE reference · x_refsource_MISC
- 44635CVE reference · exploit, x_refsource_EXPLOIT-DB
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.