CVE-2018-16188

moderate-risk

Published 2019-01-09

SQL injection vulnerability in the RICOH Interactive Whiteboard D2200 V1.3 to V2.2, D5500 V1.3 to V2.2, D5510 V1.3 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.3 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive Whiteboard Controller Type2 V3.0 to V3.1.10137.0 attached (D5520, D6510, D7500, D8400) allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Do I need to act?

0.74% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (8)

D2200 Firmware

D5500 Firmware

D5510 Firmware

D5520 Firmware

D6500 Firmware

D6510 Firmware

D7500 Firmware

D8400 Firmware

Affected Vendors

Ricoh

References (4)

Third Party Advisory https://jvn.jp/en/jp/JVN55263945/index.html

Vendor Advisory https://www.ricoh.com/info/2018/1127_1.html

Third Party Advisory https://jvn.jp/en/jp/JVN55263945/index.html

Vendor Advisory https://www.ricoh.com/info/2018/1127_1.html

/ 100

moderate-risk

Severity 32/34 · Critical

Exploitability 3/34 · Minimal

Exposure 14/34 · Moderate