cnvd - cnvd-2018-24466

CNVD-2018-24466

Vulnerability from cnvd - Published: 2018-12-04

Title

多款RICOH Interactive Whiteboard产品限提升漏洞

Description

RICOH Interactive Whiteboard D2200等都是日本理光（Ricoh）公司的多功能打印机设备。多款RICOH Interactive Whiteboard产品中存在安全漏洞。攻击者可利用该漏洞登录管理员设置页面，修改配置。

Severity

高

Patch Name

多款RICOH Interactive Whiteboard产品限提升漏洞的补丁

Patch Description

RICOH Interactive Whiteboard D2200等都是日本理光（Ricoh）公司的多功能打印机设备。多款RICOH Interactive Whiteboard产品中存在安全漏洞。攻击者可利用该漏洞登录管理员设置页面，修改配置。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接: https://www.ricoh.com/info/2018/1127_1.html

Reference

https://jvn.jp/en/jp/JVN55263945/ https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000124.html

Impacted products

Name
['Ricoh RICOH Interactive Whiteboard D2200 >=1.1，<=V2.2', 'Ricoh RICOH Interactive Whiteboard D5500 >=1.1，<=V2.2', 'Ricoh RICOH Interactive Whiteboard D5510 >=1.1，<=V2.2']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-16186"
    }
  },
  "description": "RICOH Interactive Whiteboard D2200\u7b49\u90fd\u662f\u65e5\u672c\u7406\u5149\uff08Ricoh\uff09\u516c\u53f8\u7684\u591a\u529f\u80fd\u6253\u5370\u673a\u8bbe\u5907\u3002\n\n\u591a\u6b3eRICOH Interactive Whiteboard\u4ea7\u54c1\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u767b\u5f55\u7ba1\u7406\u5458\u8bbe\u7f6e\u9875\u9762\uff0c\u4fee\u6539\u914d\u7f6e\u3002",
  "discovererName": "Ricoh",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5:\r\nhttps://www.ricoh.com/info/2018/1127_1.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-24466",
  "openTime": "2018-12-04",
  "patchDescription": "RICOH Interactive Whiteboard D2200\u7b49\u90fd\u662f\u65e5\u672c\u7406\u5149\uff08Ricoh\uff09\u516c\u53f8\u7684\u591a\u529f\u80fd\u6253\u5370\u673a\u8bbe\u5907\u3002\r\n\r\n\u591a\u6b3eRICOH Interactive Whiteboard\u4ea7\u54c1\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u767b\u5f55\u7ba1\u7406\u5458\u8bbe\u7f6e\u9875\u9762\uff0c\u4fee\u6539\u914d\u7f6e\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eRICOH Interactive Whiteboard\u4ea7\u54c1\u9650\u63d0\u5347\u6f0f\u6d1e \u7684\u8865\u4e01",
  "products": {
    "product": [
      "Ricoh RICOH Interactive Whiteboard D2200 \u003e=1.1\uff0c\u003c=V2.2",
      "Ricoh RICOH Interactive Whiteboard D5500 \u003e=1.1\uff0c\u003c=V2.2",
      "Ricoh RICOH Interactive Whiteboard D5510 \u003e=1.1\uff0c\u003c=V2.2"
    ]
  },
  "referenceLink": "https://jvn.jp/en/jp/JVN55263945/\r\nhttps://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000124.html",
  "serverity": "\u9ad8",
  "submitTime": "2018-11-29",
  "title": "\u591a\u6b3eRICOH Interactive Whiteboard\u4ea7\u54c1\u9650\u63d0\u5347\u6f0f\u6d1e"
}

CVE-2018-16186 (GCVE-0-2018-16186)

Vulnerability from cvelistv5 – Published: 2019-01-09 22:00 – Updated: 2024-08-05 10:17

Summary

RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.1 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive Whiteboard Controller Type2 V3.0 to V3.1.10137.0 attached (D5520, D6510, D7500, D8400) uses hard-coded credentials, which may allow an attacker on the same network segments to login to the administrators settings screen and change the configuration.

Severity ?

No CVSS data available.

CWE

Use of Hard-coded Credentials

Assigner

jpcert

References

URL

Tags

	https://jvn.jp/en/jp/JVN55263945/index.html	third-party-advisoryx_refsource_JVN
	https://www.ricoh.com/info/2018/1127_1.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	RICOH COMPANY, LTD.	RICOH Interactive Whiteboard	Affected: D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.1 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive Whiteboard Controller Type2 V3.0 to V3.1.10137.0 attached (D5520, D6510, D7500, D8400)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T10:17:38.396Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "JVN#55263945",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN55263945/index.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ricoh.com/info/2018/1127_1.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "RICOH Interactive Whiteboard",
          "vendor": "RICOH COMPANY, LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.1 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive Whiteboard Controller Type2 V3.0 to V3.1.10137.0 attached (D5520, D6510, D7500, D8400)"
            }
          ]
        }
      ],
      "datePublic": "2019-01-09T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.1 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive Whiteboard Controller Type2 V3.0 to V3.1.10137.0 attached (D5520, D6510, D7500, D8400) uses hard-coded credentials, which may allow an attacker on the same network segments to login to the administrators settings screen and change the configuration."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Use of Hard-coded Credentials",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-01-09T21:57:01",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "name": "JVN#55263945",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "https://jvn.jp/en/jp/JVN55263945/index.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ricoh.com/info/2018/1127_1.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2018-16186",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "RICOH Interactive Whiteboard",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.1 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive Whiteboard Controller Type2 V3.0 to V3.1.10137.0 attached (D5520, D6510, D7500, D8400)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "RICOH COMPANY, LTD."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.1 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive Whiteboard Controller Type2 V3.0 to V3.1.10137.0 attached (D5520, D6510, D7500, D8400) uses hard-coded credentials, which may allow an attacker on the same network segments to login to the administrators settings screen and change the configuration."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Use of Hard-coded Credentials"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "JVN#55263945",
              "refsource": "JVN",
              "url": "https://jvn.jp/en/jp/JVN55263945/index.html"
            },
            {
              "name": "https://www.ricoh.com/info/2018/1127_1.html",
              "refsource": "MISC",
              "url": "https://www.ricoh.com/info/2018/1127_1.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2018-16186",
    "datePublished": "2019-01-09T22:00:00",
    "dateReserved": "2018-08-30T00:00:00",
    "dateUpdated": "2024-08-05T10:17:38.396Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2018-24466

CVE-2018-16186 (GCVE-0-2018-16186)

Tags

Sightings

Nomenclature