cvelistv5 - cve-2025-48499

CVE-2025-48499 (GCVE-0-2025-48499)

Vulnerability from cvelistv5 – Published: 2025-08-04 05:17 – Updated: 2025-08-07 16:05

Summary

Out-of-bounds write vulnerability exists in FUJIFILM Business Innovation MFPs. A specially crafted IPP (Internet Printing Protocol) or LPD (Line Printer Daemon) packet may cause a denial-of-service (DoS) condition on an affected MFP. Resetting the MFP is required to recover from the denial-of-service (DoS) condition.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CWE

CWE-787 - Out-of-bounds Write

Assigner

jpcert

References

URL

Tags

	https://www.fujifilm.com/fbglobal/eng/company/new…
	https://jvn.jp/en/vu/JVNVU93897456/

Impacted products

Vendor

Product

Version

FUJIFILM Business Innovation Corp.

DocuPrint CP225 w

Affected: 01.23.02 and earlier

FUJIFILM Business Innovation Corp.	DocuPrint CP228 w	Affected: 01.23.02 and earlier
FUJIFILM Business Innovation Corp.	DocuPrint CP115 w	Affected: 01.09.00 and earlier
FUJIFILM Business Innovation Corp.	DocuPrint CP118 w	Affected: 01.09.00 and earlier
FUJIFILM Business Innovation Corp.	DocuPrint CP116 w	Affected: 01.09.00 and earlier
FUJIFILM Business Innovation Corp.	DocuPrint CP119 w	Affected: 01.09.00 and earlier
FUJIFILM Business Innovation Corp.	DocuPrint CM225 fw	Affected: 01.12.02 and earlier
FUJIFILM Business Innovation Corp.	DocuPrint CM228 fw	Affected: 01.12.02 and earlier
FUJIFILM Business Innovation Corp.	DocuPrint CM115 w	Affected: 01.09.01 and earlier
FUJIFILM Business Innovation Corp.	DocuPrint CM118 w	Affected: 01.09.01 and earlier
FUJIFILM Business Innovation Corp.	Apoes 2150 N	Affected: 01.00.47 and earlier
FUJIFILM Business Innovation Corp.	Apoes 2350 NDA	Affected: 01.00.47 and earlier
FUJIFILM Business Innovation Corp.	Apoes 2150 ND	Affected: 01.00.47 and earlier
FUJIFILM Business Innovation Corp.	Apoes 2150 NDA	Affected: 01.00.47 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-48499",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-04T16:39:52.400612Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-07T16:05:44.214Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "DocuPrint CP225 w",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.23.02 and earlier"
            }
          ]
        },
        {
          "product": "DocuPrint CP228 w",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.23.02 and earlier"
            }
          ]
        },
        {
          "product": "DocuPrint CP115 w",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.09.00 and earlier"
            }
          ]
        },
        {
          "product": "DocuPrint CP118 w",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.09.00 and earlier"
            }
          ]
        },
        {
          "product": "DocuPrint CP116 w",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.09.00 and earlier"
            }
          ]
        },
        {
          "product": "DocuPrint CP119 w",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.09.00 and earlier"
            }
          ]
        },
        {
          "product": "DocuPrint CM225 fw",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.12.02 and earlier"
            }
          ]
        },
        {
          "product": "DocuPrint CM228 fw",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.12.02 and earlier"
            }
          ]
        },
        {
          "product": "DocuPrint CM115 w",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.09.01 and earlier"
            }
          ]
        },
        {
          "product": "DocuPrint CM118 w",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.09.01 and earlier"
            }
          ]
        },
        {
          "product": "Apoes 2150 N",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.00.47 and earlier"
            }
          ]
        },
        {
          "product": "Apoes 2350 NDA",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.00.47 and earlier"
            }
          ]
        },
        {
          "product": "Apoes 2150 ND",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.00.47 and earlier"
            }
          ]
        },
        {
          "product": "Apoes 2150 NDA",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.00.47 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Out-of-bounds write vulnerability exists in FUJIFILM Business Innovation MFPs. A specially crafted IPP (Internet Printing Protocol) or LPD (Line Printer Daemon) packet may cause a denial-of-service (DoS) condition on an affected MFP. Resetting the MFP is required to recover from the denial-of-service (DoS) condition."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-04T05:17:01.537Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.fujifilm.com/fbglobal/eng/company/news/notice/2025/0804_announce.html"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU93897456/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-48499",
    "datePublished": "2025-08-04T05:17:01.537Z",
    "dateReserved": "2025-07-14T05:09:53.900Z",
    "dateUpdated": "2025-08-07T16:05:44.214Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-48499\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2025-08-04T06:15:30.377\",\"lastModified\":\"2025-08-04T15:06:15.833\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Out-of-bounds write vulnerability exists in FUJIFILM Business Innovation MFPs. A specially crafted IPP (Internet Printing Protocol) or LPD (Line Printer Daemon) packet may cause a denial-of-service (DoS) condition on an affected MFP. Resetting the MFP is required to recover from the denial-of-service (DoS) condition.\"},{\"lang\":\"es\",\"value\":\"Existe una vulnerabilidad de escritura fuera de los l\u00edmites en FUJIFILM Business Innovation MFPs. Un paquete IPP (Internet Printing Protocol) o LPD (Line Printer Daemon) especialmente manipulado puede causar una denegaci\u00f3n de servicio (DoS) en una impresora multifunci\u00f3n afectada. Es necesario reiniciar la impresora multifunci\u00f3n para recuperarse de la denegaci\u00f3n de servicio (DoS).\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"vultures@jpcert.or.jp\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":6.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"vultures@jpcert.or.jp\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"vultures@jpcert.or.jp\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"references\":[{\"url\":\"https://jvn.jp/en/vu/JVNVU93897456/\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://www.fujifilm.com/fbglobal/eng/company/news/notice/2025/0804_announce.html\",\"source\":\"vultures@jpcert.or.jp\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-48499\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-08-04T16:39:52.400612Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-08-04T16:39:59.897Z\"}}], \"cna\": {\"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\"}, \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 6.9, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N\"}, \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"FUJIFILM Business Innovation Corp.\", \"product\": \"DocuPrint CP225 w\", \"versions\": [{\"status\": \"affected\", \"version\": \"01.23.02 and earlier\"}]}, {\"vendor\": \"FUJIFILM Business Innovation Corp.\", \"product\": \"DocuPrint CP228 w\", \"versions\": [{\"status\": \"affected\", \"version\": \"01.23.02 and earlier\"}]}, {\"vendor\": \"FUJIFILM Business Innovation Corp.\", \"product\": \"DocuPrint CP115 w\", \"versions\": [{\"status\": \"affected\", \"version\": \"01.09.00 and earlier\"}]}, {\"vendor\": \"FUJIFILM Business Innovation Corp.\", \"product\": \"DocuPrint CP118 w\", \"versions\": [{\"status\": \"affected\", \"version\": \"01.09.00 and earlier\"}]}, {\"vendor\": \"FUJIFILM Business Innovation Corp.\", \"product\": \"DocuPrint CP116 w\", \"versions\": [{\"status\": \"affected\", \"version\": \"01.09.00 and earlier\"}]}, {\"vendor\": \"FUJIFILM Business Innovation Corp.\", \"product\": \"DocuPrint CP119 w\", \"versions\": [{\"status\": \"affected\", \"version\": \"01.09.00 and earlier\"}]}, {\"vendor\": \"FUJIFILM Business Innovation Corp.\", \"product\": \"DocuPrint CM225 fw\", \"versions\": [{\"status\": \"affected\", \"version\": \"01.12.02 and earlier\"}]}, {\"vendor\": \"FUJIFILM Business Innovation Corp.\", \"product\": \"DocuPrint CM228 fw\", \"versions\": [{\"status\": \"affected\", \"version\": \"01.12.02 and earlier\"}]}, {\"vendor\": \"FUJIFILM Business Innovation Corp.\", \"product\": \"DocuPrint CM115 w\", \"versions\": [{\"status\": \"affected\", \"version\": \"01.09.01 and earlier\"}]}, {\"vendor\": \"FUJIFILM Business Innovation Corp.\", \"product\": \"DocuPrint CM118 w\", \"versions\": [{\"status\": \"affected\", \"version\": \"01.09.01 and earlier\"}]}, {\"vendor\": \"FUJIFILM Business Innovation Corp.\", \"product\": \"Apoes 2150 N\", \"versions\": [{\"status\": \"affected\", \"version\": \"01.00.47 and earlier\"}]}, {\"vendor\": \"FUJIFILM Business Innovation Corp.\", \"product\": \"Apoes 2350 NDA\", \"versions\": [{\"status\": \"affected\", \"version\": \"01.00.47 and earlier\"}]}, {\"vendor\": \"FUJIFILM Business Innovation Corp.\", \"product\": \"Apoes 2150 ND\", \"versions\": [{\"status\": \"affected\", \"version\": \"01.00.47 and earlier\"}]}, {\"vendor\": \"FUJIFILM Business Innovation Corp.\", \"product\": \"Apoes 2150 NDA\", \"versions\": [{\"status\": \"affected\", \"version\": \"01.00.47 and earlier\"}]}], \"references\": [{\"url\": \"https://www.fujifilm.com/fbglobal/eng/company/news/notice/2025/0804_announce.html\"}, {\"url\": \"https://jvn.jp/en/vu/JVNVU93897456/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Out-of-bounds write vulnerability exists in FUJIFILM Business Innovation MFPs. A specially crafted IPP (Internet Printing Protocol) or LPD (Line Printer Daemon) packet may cause a denial-of-service (DoS) condition on an affected MFP. Resetting the MFP is required to recover from the denial-of-service (DoS) condition.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en-US\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"shortName\": \"jpcert\", \"dateUpdated\": \"2025-08-04T05:17:01.537Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-48499\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-08-07T16:05:44.214Z\", \"dateReserved\": \"2025-07-14T05:09:53.900Z\", \"assignerOrgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"datePublished\": \"2025-08-04T05:17:01.537Z\", \"assignerShortName\": \"jpcert\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

JVNDB-2025-010603

Vulnerability from jvndb - Published: 2025-08-05 11:29 - Updated:2025-08-05 11:29

Severity ?

5.3 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

Out-of-bounds write vulnerability in FUJIFILM Business Innovation MFPs

Details

Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp. contain the following vulnerability.

Out-of-bounds Write (CWE-787) - CVE-2025-48499

Jia-Ju Bai, Rui-Nan Hu, Dong Zhang, and Zhen-Yu Guan of School of Cyber Science and Technology of Beihang University reported this vulnerability to FUJIFILM Business Innovation Corp. and coordinated. After the coordination was completed, FUJIFILM Business Innovation Corp. reported the case to JPCERT/CC to notify users of the solution through JVN.

References

Type

URL

	JVN	https://jvn.jp/en/vu/JVNVU93897456/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-48499
	Out-of-bounds Write(CWE-787)	https://cwe.mitre.org/data/definitions/787.html

Impacted products

Vendor

Product

	FUJIFILM Business Innovation Corp. (former Fuji Xerox Co., Ltd.)	Apeos
	FUJIFILM Business Innovation Corp. (former Fuji Xerox Co., Ltd.)	DocuPrint

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-010603.html",
  "dc:date": "2025-08-05T11:29+09:00",
  "dcterms:issued": "2025-08-05T11:29+09:00",
  "dcterms:modified": "2025-08-05T11:29+09:00",
  "description": "Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp. contain the following vulnerability.\r\n\u003cul\u003e\u003cli\u003eOut-of-bounds Write (CWE-787) - CVE-2025-48499\u003c/li\u003e\u003c/ul\u003e\r\nJia-Ju Bai, Rui-Nan Hu, Dong Zhang, and Zhen-Yu Guan of School of Cyber Science and Technology of Beihang University reported this vulnerability to FUJIFILM Business Innovation Corp. and coordinated. After the coordination was completed, FUJIFILM Business Innovation Corp. reported the case to JPCERT/CC to notify users of the solution through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-010603.html",
  "sec:cpe": [
    {
      "#text": "cpe:/h:fuji_xerox:apeos",
      "@product": "Apeos",
      "@vendor": "FUJIFILM Business Innovation Corp. (former Fuji Xerox Co., Ltd.)",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/h:fuji_xerox:docuprint",
      "@product": "DocuPrint",
      "@vendor": "FUJIFILM Business Innovation Corp. (former Fuji Xerox Co., Ltd.)",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "5.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-010603",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU93897456/index.html",
      "@id": "JVNVU#93897456",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-48499",
      "@id": "CVE-2025-48499",
      "@source": "CVE"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/787.html",
      "@id": "CWE-787",
      "@title": "Out-of-bounds Write(CWE-787)"
    }
  ],
  "title": "Out-of-bounds write vulnerability in FUJIFILM Business Innovation MFPs"
}

GHSA-RP36-J278-P677

Vulnerability from github – Published: 2025-08-04 06:33 – Updated: 2025-08-04 06:33

Details

Severity ?

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-48499"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-04T06:15:30Z",
    "severity": "MODERATE"
  },
  "details": "Out-of-bounds write vulnerability exists in FUJIFILM Business Innovation MFPs. A specially crafted IPP (Internet Printing Protocol) or LPD (Line Printer Daemon) packet may cause a denial-of-service (DoS) condition on an affected MFP. Resetting the MFP is required to recover from the denial-of-service (DoS) condition.",
  "id": "GHSA-rp36-j278-p677",
  "modified": "2025-08-04T06:33:32Z",
  "published": "2025-08-04T06:33:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48499"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/vu/JVNVU93897456"
    },
    {
      "type": "WEB",
      "url": "https://www.fujifilm.com/fbglobal/eng/company/news/notice/2025/0804_announce.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

FKIE_CVE-2025-48499

Vulnerability from fkie_nvd - Published: 2025-08-04 06:15 - Updated: 2025-08-04 15:06

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

References

	URL	Tags
	vultures@jpcert.or.jp	https://jvn.jp/en/vu/JVNVU93897456/
	vultures@jpcert.or.jp	https://www.fujifilm.com/fbglobal/eng/company/news/notice/2025/0804_announce.html

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Out-of-bounds write vulnerability exists in FUJIFILM Business Innovation MFPs. A specially crafted IPP (Internet Printing Protocol) or LPD (Line Printer Daemon) packet may cause a denial-of-service (DoS) condition on an affected MFP. Resetting the MFP is required to recover from the denial-of-service (DoS) condition."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de escritura fuera de los l\u00edmites en FUJIFILM Business Innovation MFPs. Un paquete IPP (Internet Printing Protocol) o LPD (Line Printer Daemon) especialmente manipulado puede causar una denegaci\u00f3n de servicio (DoS) en una impresora multifunci\u00f3n afectada. Es necesario reiniciar la impresora multifunci\u00f3n para recuperarse de la denegaci\u00f3n de servicio (DoS)."
    }
  ],
  "id": "CVE-2025-48499",
  "lastModified": "2025-08-04T15:06:15.833",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "vultures@jpcert.or.jp",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "vultures@jpcert.or.jp",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-08-04T06:15:30.377",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://jvn.jp/en/vu/JVNVU93897456/"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://www.fujifilm.com/fbglobal/eng/company/news/notice/2025/0804_announce.html"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "vultures@jpcert.or.jp",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-48499 (GCVE-0-2025-48499)

JVNDB-2025-010603

GHSA-RP36-J278-P677

FKIE_CVE-2025-48499

Tags

Sightings

Nomenclature