A series of vulnerabilities were discovered in Ricoh SP C250DN multi-function printers running the firmware version 1.05. If exploited, these vulnerabilities could affect Windows 10 users.
Vulnerabilities in Ricoh SP C250DN printer
NCC Researchers discovered multiple vulnerabilities in Ricoh SP C250DN 1.05 devices, allowing cybercriminals to perform Brute Force attacks, Denial of Service attacks, among others.
Due to the lack of account lockout implementation, Ricoh SP C250DN 1.05 devices developed a vulnerability CVE-2019-14299 in the authentication method. As a result, hackers could extract local account credentials from the device via brute force attacks.
The devices affected by a wrong LPD service implementation remained vulnerable to denial of service attack. If exploited, CVE-2019-14303 could allow cybercriminals to crash the devices using unauthenticated crafted packets.
Researchers also found FTP service credentials hardcoded within the firmware of the affected devices, the vulnerability CVE-2019-14309 further allowing an attacker to access and read information stored on the shared FTP folders.
Brute Force attack, Denial of service, and more
The device affected by memory corruption vulnerability CVE-2019-14310 could allow an attacker to execute arbitrary code on the device. If exploited, it could enable remote code execution, allowing hackers to crash the affected device.
Similar to the wrong LPD vulnerability, hackers could crash the system by exploiting the vulnerability using arbitrary code execution on the device. Meanwhile, NCC had this to say in its advisory:
“A memory corruption has been identified in the way of how the embedded device parsed the IPP packets. This would potentially allow an attacker to execute arbitrary code on the device.”
Meanwhile, Ricoh has already released a firmware patch version 1.10 addressing most of these vulnerabilities.
Although these vulnerabilities mainly affected the SP C250DN, researchers are awaiting vendor confirmation on the affected release for other Ricoh printer models like the SP C250SF, SP C252SF, and SP C252DN.
Attacks on printers are common these days. In 2018, hackers supporting a popular YouTuber PewDiePie had hacked into thousands of printers to print out a message in support of the channel, further blackmailing victims to subscribe to it.
