PT-2020-9544 · Ricoh+1 · Ricoh Sp C250Dn+1

Published 2020-03-13 · Updated 2020-11-20 · CVE-2019-14299

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Ricoh SP C250DN version 1.05

Description: The issue concerns an authentication method that is vulnerable to brute force attacks. Specifically, some Ricoh printers, including the affected version, did not implement account lockout. This oversight made it possible to obtain local account credentials by using brute force methods.

Recommendations: For Ricoh SP C250DN version 1.05, consider implementing account lockout policies to prevent brute force attacks. As a temporary workaround, restrict access to the device's authentication mechanism until a patch or fix is available.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2019-14299

SUSE-SU-2020:3474-1

Affected Products

Ricoh Sp C250Dn

Suse

References · 41

• https://ricoh-usa.com/en/support-and-download · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:3474-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-14299 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14299 · Security Note
• https://bugzilla.suse.com/1143463 · Note
• https://bugzilla.suse.com/1167209 · Note
• https://suse.com/security/cve/CVE-2019-14195 · Note
• https://bugzilla.suse.com/1143823 · Note
• https://bugzilla.suse.com/1143824 · Note
• https://suse.com/security/cve/CVE-2019-14193 · Note
• https://suse.com/security/cve/CVE-2019-14194 · Note
• https://bugzilla.suse.com/1143825 · Note
• https://suse.com/security/cve/CVE-2019-14203 · Note
• https://bugzilla.suse.com/1143818 · Note
• https://suse.com/security/cve/CVE-2019-14201 · Note