CVE-2022-37406

low-risk
Published 2022-12-07

Cross-site scripting vulnerability in Aficio SP 4210N firmware versions prior to Web Support 1.05 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script.

Do I need to act?

-
0.40% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.8/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Aficio Sp 4210N Firmware

Affected Vendors

Ricoh

References (6)

Third Party Advisory https://jvn.jp/en/jp/JVN24659622/index.html
Product https://support.ricoh.com/bb/html/dr_ut_e/rc3/model/sp42/sp42.htm
Release Notes https://support.ricoh.com/bbv2/html/dr_ut_d/ipsio/history/w/bb/pub_j/dr_ut_d/410...
Third Party Advisory https://jvn.jp/en/jp/JVN24659622/index.html
Product https://support.ricoh.com/bb/html/dr_ut_e/rc3/model/sp42/sp42.htm
Release Notes https://support.ricoh.com/bbv2/html/dr_ut_d/ipsio/history/w/bb/pub_j/dr_ut_d/410...
26
/ 100
low-risk
Severity 19/34 · Moderate
Exploitability 2/34 · Minimal
Exposure 5/34 · Minimal