CVE-2018-16186

09.01.2019, 23:29

RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.1 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive Whiteboard Controller Type2 V3.0 to V3.1.10137.0 attached (D5520, D6510, D7500, D8400) uses hard-coded credentials, which may allow an attacker on the same network segments to login to the administrators settings screen and change the configuration.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	8.8 HIGH	ADJACENT_NETWORK	LOW	NONE	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
jpcert	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 31%

Vendor	Product	Version
ricoh	d2200_firmware	1.1 ≤ 𝑥 ≤ 2.2
ricoh	d5500_firmware	1.1 ≤ 𝑥 ≤ 2.2
ricoh	d5510_firmware	1.1 ≤ 𝑥 ≤ 2.2
ricoh	d5520_firmware	1.1 ≤ 𝑥 ≤ 2.2
ricoh	d5520_firmware	3.0 ≤ 𝑥 ≤ 3.1.10137.0
ricoh	d6500_firmware	1.1 ≤ 𝑥 ≤ 2.2
ricoh	d6510_firmware	1.1 ≤ 𝑥 ≤ 2.2
ricoh	d6510_firmware	3.0 ≤ 𝑥 ≤ 3.1.10137.0
ricoh	d7500_firmware	1.1 ≤ 𝑥 ≤ 2.2
ricoh	d7500_firmware	3.0 ≤ 𝑥 ≤ 3.1.10137.0
ricoh	d8400_firmware	1.1 ≤ 𝑥 ≤ 2.2
ricoh	d8400_firmware	3.0 ≤ 𝑥 ≤ 3.1.10137.0

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-798 - Use of Hard-coded Credentials
The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

References

https://jvn.jp/en/jp/JVN55263945/index.html

https://www.ricoh.com/info/2018/1127_1.html

https://jvn.jp/en/jp/JVN55263945/index.html

https://www.ricoh.com/info/2018/1127_1.html