CVE-2019-14307 - CVE House
Back to Database
Status published High CVE-2019-14307

Several Ricoh printers have multiple buffer overflows parsing HTTP parameter...

Vulnerability Description

Several Ricoh printers have multiple buffer overflows parsing HTTP parameter settings for SNMP, which allow an attacker to cause a denial of service or code execution via crafted requests to the web server. Affected firmware versions depend on the printer models. One affected configuration is cpe:2.3:o:ricoh:sp_c250dn_firmware:-:*:*:*:*:*:*:* up to (including) 1.06 running on cpe:2.3:o:ricoh:sp_c250dn:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252dn:-:*:*:*:*:*:*:*. Another affected configuration is cpe:2.3:o:ricoh:sp_c250sf_firmware:-:*:*:*:*:*:*:* up to (including) 1.12 running on cpe:2.3:o:ricoh:sp_c250sf:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252sf:-:*:*:*:*:*:*:*.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-14307

Credits & Attribution

No credits recorded in the NVD database.

References

More from ricoh

View All →
CVE-2022-43969
Ricoh mp_c4504ex devices with firmware 1.06 mishandle credentials....
Unknown 0
CVE-2021-33945
RICOH Printer series SP products 320DN, SP 325DNw, SP 320SN,...
Critical 9.8
CVE-2019-7751
A directory traversal and local file inclusion vulnerability in FPProducerInternetServer.exe...
High 7.5
CVE-2019-20001
An issue was discovered in RICOH Streamline NX Client Tool...
High 7.8
CVE-2019-19363
An issue was discovered in Ricoh (including Savin and Lanier)...
High 7.8

Affected Vendor

Affected Software

sp c250sf firmware, sp c252sf firmware, sp c250dn firmware, sp c252dn firmware
Vulnerable Versions:
0

Timeline

Official Publish: August 26th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.