CVE-2019-14305

Severity Score

9.8

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Several Ricoh printers have multiple buffer overflows parsing HTTP parameter settings for Wi-Fi, mDNS, POP3, SMTP, and notification alerts, which allow an attacker to cause a denial of service or code execution via crafted requests to the web server. Affected firmware versions depend on the printer models. One affected configuration is cpe:2.3:o:ricoh:sp_c250dn_firmware:-:*:*:*:*:*:*:* up to (including) 1.06 running on cpe:2.3:o:ricoh:sp_c250dn:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252dn:-:*:*:*:*:*:*:*. Another affected configuration is cpe:2.3:o:ricoh:sp_c250sf_firmware:-:*:*:*:*:*:*:* up to (including) 1.12 running on cpe:2.3:o:ricoh:sp_c250sf:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252sf:-:*:*:*:*:*:*:*.

Varias impresoras Ricoh presentan múltiples desbordamientos de búfer al analizar la configuración de parámetros HTTP para Wi-Fi, mDNS, POP3, SMTP y alertas de notificación, lo que permite a un atacante causar una denegación de servicio o ejecución de código por medio de peticiones diseñadas hacia el servidor web. Las versiones de firmware afectadas dependen de los modelos de impresora. Una configuración afectada es cpe:2.3:o:ricoh:sp_c250dn_firmware:-:*:*:*:*:*:*:* hasta versión 1.06 inclusive ejecutándose en cpe:2.3:o:ricoh:sp_c250dn:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252dn:-:*:*:*:*:*:*:*. Otra configuración afectada es cpe:2.3:o:ricoh:sp_c250sf_firmware:-:*:*:*:*:*:*:* hasta versión 1.12 inclusive ejecutándose en cpe:2.3:o:ricoh:sp_c250sf:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252sf:-:*:*:*:*:*:*:*.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-07-27 CVE Reserved
2019-08-26 CVE Published
2024-08-05 CVE Updated
2024-12-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CAPEC

References (3)

URL	Tag	Source
http://jvn.jp/en/jp/JVN11708203/index.html	Third Party Advisory
https://www.ricoh-usa.com/en/support-and-download	Product

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://www.ricoh.com/info/2019/0823_1	2019-09-13

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Ricoh Search vendor "Ricoh"	Sp C250sf Firmware Search vendor "Ricoh" for product "Sp C250sf Firmware"	< 1.13 Search vendor "Ricoh" for product "Sp C250sf Firmware" and version " < 1.13"	-	Affected	in	Ricoh Search vendor "Ricoh"	Sp C250sf Search vendor "Ricoh" for product "Sp C250sf"	-	-	Safe
Ricoh Search vendor "Ricoh"	Sp C252sf Firmware Search vendor "Ricoh" for product "Sp C252sf Firmware"	< 1.13 Search vendor "Ricoh" for product "Sp C252sf Firmware" and version " < 1.13"	-	Affected	in	Ricoh Search vendor "Ricoh"	Sp C252sf Search vendor "Ricoh" for product "Sp C252sf"	-	-	Safe
Ricoh Search vendor "Ricoh"	Sp C250dn Firmware Search vendor "Ricoh" for product "Sp C250dn Firmware"	< 1.07 Search vendor "Ricoh" for product "Sp C250dn Firmware" and version " < 1.07"	-	Affected	in	Ricoh Search vendor "Ricoh"	Sp C250dn Search vendor "Ricoh" for product "Sp C250dn"	-	-	Safe
Ricoh Search vendor "Ricoh"	Sp C252dn Firmware Search vendor "Ricoh" for product "Sp C252dn Firmware"	< 1.07 Search vendor "Ricoh" for product "Sp C252dn Firmware" and version " < 1.07"	-	Affected	in	Ricoh Search vendor "Ricoh"	Sp C252dn Search vendor "Ricoh" for product "Sp C252dn"	-	-	Safe