jvndb - jvndb-2025-010603

JVNDB-2025-010603

Vulnerability from jvndb - Published: 2025-08-05 11:29 - Updated:2025-08-05 11:29

Severity ?

5.3 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

Out-of-bounds write vulnerability in FUJIFILM Business Innovation MFPs

Details

Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp. contain the following vulnerability.

Out-of-bounds Write (CWE-787) - CVE-2025-48499

Jia-Ju Bai, Rui-Nan Hu, Dong Zhang, and Zhen-Yu Guan of School of Cyber Science and Technology of Beihang University reported this vulnerability to FUJIFILM Business Innovation Corp. and coordinated. After the coordination was completed, FUJIFILM Business Innovation Corp. reported the case to JPCERT/CC to notify users of the solution through JVN.

References

Type

URL

	JVN	https://jvn.jp/en/vu/JVNVU93897456/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-48499
	Out-of-bounds Write(CWE-787)	https://cwe.mitre.org/data/definitions/787.html

Impacted products

Vendor

Product

	FUJIFILM Business Innovation Corp. (former Fuji Xerox Co., Ltd.)	Apeos
	FUJIFILM Business Innovation Corp. (former Fuji Xerox Co., Ltd.)	DocuPrint

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-010603.html",
  "dc:date": "2025-08-05T11:29+09:00",
  "dcterms:issued": "2025-08-05T11:29+09:00",
  "dcterms:modified": "2025-08-05T11:29+09:00",
  "description": "Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp. contain the following vulnerability.\r\n\u003cul\u003e\u003cli\u003eOut-of-bounds Write (CWE-787) - CVE-2025-48499\u003c/li\u003e\u003c/ul\u003e\r\nJia-Ju Bai, Rui-Nan Hu, Dong Zhang, and Zhen-Yu Guan of School of Cyber Science and Technology of Beihang University reported this vulnerability to FUJIFILM Business Innovation Corp. and coordinated. After the coordination was completed, FUJIFILM Business Innovation Corp. reported the case to JPCERT/CC to notify users of the solution through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-010603.html",
  "sec:cpe": [
    {
      "#text": "cpe:/h:fuji_xerox:apeos",
      "@product": "Apeos",
      "@vendor": "FUJIFILM Business Innovation Corp. (former Fuji Xerox Co., Ltd.)",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/h:fuji_xerox:docuprint",
      "@product": "DocuPrint",
      "@vendor": "FUJIFILM Business Innovation Corp. (former Fuji Xerox Co., Ltd.)",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "5.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-010603",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU93897456/index.html",
      "@id": "JVNVU#93897456",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-48499",
      "@id": "CVE-2025-48499",
      "@source": "CVE"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/787.html",
      "@id": "CWE-787",
      "@title": "Out-of-bounds Write(CWE-787)"
    }
  ],
  "title": "Out-of-bounds write vulnerability in FUJIFILM Business Innovation MFPs"
}

CVE-2025-48499 (GCVE-0-2025-48499)

Vulnerability from cvelistv5 – Published: 2025-08-04 05:17 – Updated: 2025-08-07 16:05

Summary

Out-of-bounds write vulnerability exists in FUJIFILM Business Innovation MFPs. A specially crafted IPP (Internet Printing Protocol) or LPD (Line Printer Daemon) packet may cause a denial-of-service (DoS) condition on an affected MFP. Resetting the MFP is required to recover from the denial-of-service (DoS) condition.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CWE

CWE-787 - Out-of-bounds Write

Assigner

jpcert

References

URL

Tags

	https://www.fujifilm.com/fbglobal/eng/company/new…
	https://jvn.jp/en/vu/JVNVU93897456/

Impacted products

Vendor

Product

Version

FUJIFILM Business Innovation Corp.

DocuPrint CP225 w

Affected: 01.23.02 and earlier

FUJIFILM Business Innovation Corp.	DocuPrint CP228 w	Affected: 01.23.02 and earlier
FUJIFILM Business Innovation Corp.	DocuPrint CP115 w	Affected: 01.09.00 and earlier
FUJIFILM Business Innovation Corp.	DocuPrint CP118 w	Affected: 01.09.00 and earlier
FUJIFILM Business Innovation Corp.	DocuPrint CP116 w	Affected: 01.09.00 and earlier
FUJIFILM Business Innovation Corp.	DocuPrint CP119 w	Affected: 01.09.00 and earlier
FUJIFILM Business Innovation Corp.	DocuPrint CM225 fw	Affected: 01.12.02 and earlier
FUJIFILM Business Innovation Corp.	DocuPrint CM228 fw	Affected: 01.12.02 and earlier
FUJIFILM Business Innovation Corp.	DocuPrint CM115 w	Affected: 01.09.01 and earlier
FUJIFILM Business Innovation Corp.	DocuPrint CM118 w	Affected: 01.09.01 and earlier
FUJIFILM Business Innovation Corp.	Apoes 2150 N	Affected: 01.00.47 and earlier
FUJIFILM Business Innovation Corp.	Apoes 2350 NDA	Affected: 01.00.47 and earlier
FUJIFILM Business Innovation Corp.	Apoes 2150 ND	Affected: 01.00.47 and earlier
FUJIFILM Business Innovation Corp.	Apoes 2150 NDA	Affected: 01.00.47 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-48499",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-04T16:39:52.400612Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-07T16:05:44.214Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "DocuPrint CP225 w",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.23.02 and earlier"
            }
          ]
        },
        {
          "product": "DocuPrint CP228 w",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.23.02 and earlier"
            }
          ]
        },
        {
          "product": "DocuPrint CP115 w",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.09.00 and earlier"
            }
          ]
        },
        {
          "product": "DocuPrint CP118 w",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.09.00 and earlier"
            }
          ]
        },
        {
          "product": "DocuPrint CP116 w",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.09.00 and earlier"
            }
          ]
        },
        {
          "product": "DocuPrint CP119 w",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.09.00 and earlier"
            }
          ]
        },
        {
          "product": "DocuPrint CM225 fw",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.12.02 and earlier"
            }
          ]
        },
        {
          "product": "DocuPrint CM228 fw",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.12.02 and earlier"
            }
          ]
        },
        {
          "product": "DocuPrint CM115 w",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.09.01 and earlier"
            }
          ]
        },
        {
          "product": "DocuPrint CM118 w",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.09.01 and earlier"
            }
          ]
        },
        {
          "product": "Apoes 2150 N",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.00.47 and earlier"
            }
          ]
        },
        {
          "product": "Apoes 2350 NDA",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.00.47 and earlier"
            }
          ]
        },
        {
          "product": "Apoes 2150 ND",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.00.47 and earlier"
            }
          ]
        },
        {
          "product": "Apoes 2150 NDA",
          "vendor": "FUJIFILM Business Innovation Corp.",
          "versions": [
            {
              "status": "affected",
              "version": "01.00.47 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Out-of-bounds write vulnerability exists in FUJIFILM Business Innovation MFPs. A specially crafted IPP (Internet Printing Protocol) or LPD (Line Printer Daemon) packet may cause a denial-of-service (DoS) condition on an affected MFP. Resetting the MFP is required to recover from the denial-of-service (DoS) condition."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-04T05:17:01.537Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.fujifilm.com/fbglobal/eng/company/news/notice/2025/0804_announce.html"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU93897456/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-48499",
    "datePublished": "2025-08-04T05:17:01.537Z",
    "dateReserved": "2025-07-14T05:09:53.900Z",
    "dateUpdated": "2025-08-07T16:05:44.214Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

JVNDB-2025-010603

CVE-2025-48499 (GCVE-0-2025-48499)

Tags

Sightings

Nomenclature