PT-2019-13597 · Ricoh · Ricoh Sp C250Dn+1

Published 2019-08-26 · Updated 2019-09-13 · CVE-2019-14305

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ricoh SP C250DN firmware versions up to 1.06 Ricoh SP C250SF firmware versions up to 1.12

Description The issue affects several Ricoh printer models, where multiple buffer overflows occur when parsing HTTP parameter settings for various protocols, including Wi-Fi, mDNS, POP3, SMTP, and notification alerts. This allows an attacker to cause a denial of service or achieve code execution by sending crafted requests to the web server.

Recommendations For Ricoh SP C250DN firmware versions up to 1.06, update the firmware to a version later than 1.06. For Ricoh SP C250SF firmware versions up to 1.12, update the firmware to a version later than 1.12. As a temporary workaround, consider restricting access to the web server to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2019-14305

Affected Products

Ricoh Sp C250Dn

Ricoh Sp C250Sf

References · 5

• https://osv.dev/vulnerability/CVE-2019-14305 · Vendor Advisory
• https://ricoh.com/info/2019/0823_1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14305 · Security Note
• http://jvn.jp/en/jp/JVN11708203/index.html · Note
• https://ricoh-usa.com/en/support-and-download · Note