CVE-2019-14305 Memory corruption in n/a
Attackers can execute arbitrary code or cause denial of service on Ricoh printers via crafted HTTP requests exploiting buffer overflows in firmware.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-14305?
CVE-2019-14305 is a high-severity memory corruption vulnerability in n/a, published on 26 Aug 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Several Ricoh printers have multiple buffer overflows parsing HTTP parameter settings for Wi-Fi, mDNS, POP3, SMTP, and notification alerts, which allow an attacker to cause a denial of service or code execution via crafted requests to the web server. Affected firmware versions depend on the printer models. One affected configuration is cpe:2.3:o:ricoh:sp_c250dn_firmware:-:*:*:*:*:*:*:* up to (including) 1.06 running on cpe:2.3:o:ricoh:sp_c250dn:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252dn:-:*:*:*:*:*:*:*. Another affected configuration is cpe:2.3:o:ricoh:sp_c250sf_firmware:-:*:*:*:*:*:*:* up to (including) 1.12 running on cpe:2.3:o:ricoh:sp_c250sf:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252sf:-:*:*:*:*:*:*:*.
Weakness: CWE-119
Which versions are affected by CVE-2019-14305?
It affects 4 products.
Products include Ricoh Sp C250dn Firmware, Ricoh Sp C250sf Firmware, Ricoh Sp C252dn Firmware, Ricoh Sp C252sf Firmware.
How do I fix CVE-2019-14305?
No fix has been published for CVE-2019-14305 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2019-14305 being exploited?
There is no known exploitation of CVE-2019-14305 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-6pmg-9f43-8p69.