PT-2023-22959 · Unknown · Printer Driver Packager Nx

Published 2023-06-19 · Updated 2024-12-12 · CVE-2023-30759

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Printer Driver Packager NX versions 1.0.02 through 1.1.25

Description The issue arises when the driver installation package created by Printer Driver Packager NX fails to detect its modification, potentially spawning an unexpected process with administrative privilege. If a non-administrative user modifies the package and runs it on a target PC, an arbitrary program may be executed with administrative privilege.

Recommendations For versions 1.0.02 through 1.1.25, as a temporary workaround, consider restricting the use of the driver installation package to prevent non-administrative users from modifying and executing it, until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-352

CWE-345

Related Identifiers

CVE-2023-30759

Affected Products

Printer Driver Packager Nx

References · 7

• https://osv.dev/vulnerability/CVE-2023-30759 · Vendor Advisory
• https://ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2023-000001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30759 · Security Note
• https://ricoh.com/products/security/vulnerabilities/adv?id=ricoh-prod000048-2023-000001 · Vendor Advisory
• https://t.me/cvenotify/52616 · Telegram Post
• https://jvn.jp/en/vu/JVNVU92207133 · Note
• https://t.me/cvenotify/104107 · Telegram Post