Threat database

A denial of service vulnerability exists in Ricoh SP 330DN, SP 221, SP C252SF, and Aficio SP 3500SF devices up to version 20260813. The flaw is in the HTTP Multipart Form-Data Parser component and can be exploited remotely without user interaction. The vendor has not responded to the disclosure, and a public exploit is available.

Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. do not implement restrictions on SSH port forwarding, allowing to connect to arbitrary destinations. When SSH is enabled on an affected product, SSH port forwarding may be leveraged to connect to other node on the LAN.

Multiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor contain a reflected cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who accesses a crafted URL.

Multiple printer drivers from Ricoh Company, Ltd. and KONICA MINOLTA JAPAN, INC. have a privilege escalation vulnerability due to an uncontrolled search path element. An attacker with login access to a system running an affected driver could exploit this to elevate privileges using a specially crafted driver. The vulnerability has a high severity score of 7.8 but no specific affected versions or patches have been disclosed yet.

Open redirect vulnerability exists in Multiple laser printers and MFPs which implement Ricoh Web Image Monitor. When accessing a specially crafted URL, the user may be redirected to an arbitrary website. As a result, the user may become a victim of a phishing attack.

The installer for ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール versions prior to Ver.1.3.7 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with administrative privileges.

CVE-2026-21409 is an authorization bypass vulnerability in Ricoh Streamline NX versions 3.5.1 through 24R3. The flaw allows a man-in-the-middle attacker to intercept communications and craft requests that can retrieve user registration information and OpenID Connect (OIDC) tokens. This vulnerability does not require user interaction or authentication but does require the attacker to be positioned to intercept network traffic. The CVSS score is 5.9 (medium severity) due to the high impact on confidentiality but no impact on integrity or availability. Exploitation could lead to unauthorized access to sensitive user identity tokens, potentially enabling further impersonation or access escalation. No known exploits are currently reported in the wild. European organizations using affected Ricoh Streamline NX versions are at risk, especially those with sensitive document workflows relying on OIDC authentication.

RICOH Streamline NX versions 3.5.1 to 24R3 are vulnerable to tampering with operation history. If an attacker can perform a man-in-the-middle attack, they may alter the values of HTTP requests, which could result in tampering with the operation history of the product’s management tool.

A reflected cross-site scripting vulnerability via a specific parameter exists in SLNX Help Documentation of RICOH Streamline NX. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of the user who accessed the product.

RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.7.0 contains an issue with use of less trusted source, which may allow an attacker who can conduct a man-in-the-middle attack to eavesdrop upgrade requests and execute a malicious DLL with custom code.

Path traversal vulnerability exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0. If this vulnerability is exploited, arbitrary code may be executed on the PC where the product is running by tampering with specific files used on the product.

External control of file name or path issue exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0. If an attacker sends a specially crafted request, arbitrary files in the file system can be overwritten with log data.