CVE-2019-14300
Description
Several Ricoh printers have multiple buffer overflows parsing HTTP cookie headers, which allow an attacker to cause a denial of service or code execution via crafted requests to the web server. Affected firmware versions depend on the printer models. One affected configuration is cpe:2.3:o:ricoh:sp_c250dn_firmware:-:*:*:*:*:*:*:* up to (including) 1.06 running on cpe:2.3:o:ricoh:sp_c250dn:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252dn:-:*:*:*:*:*:*:*. Another affected configuration is cpe:2.3:o:ricoh:sp_c250sf_firmware:-:*:*:*:*:*:*:* up to (including) 1.12 running on cpe:2.3:o:ricoh:sp_c250sf:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252sf:-:*:*:*:*:*:*:*.
How to fix
- ricoh sp_c250sf_firmware1.13 or later
- ricoh sp_c252sf_firmware1.13 or later
- ricoh sp_c250dn_firmware1.07 or later
- ricoh sp_c252dn_firmware1.07 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ricoh sp_c250sf_firmware | v < 1.13 | 1.13 |
| ricoh sp_c252sf_firmware | v < 1.13 | 1.13 |
| ricoh sp_c250dn_firmware | v < 1.07 | 1.07 |
| ricoh sp_c252dn_firmware | v < 1.07 | 1.07 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.