EUVD-2026-40255
GHSA-wvcg-328f-hx5j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered reflected XSS requiring user interaction (UI:R); scope changes to browser (S:C); low C and I on browser context only, no availability impact.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
2DescriptionCVE.org
Multiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor contain a reflected cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who accesses Web Image Monitor.
AnalysisAI
Reflected cross-site scripting in Ricoh Web Image Monitor allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browser of any user who visits a specially crafted URL pointing to the printer's web management interface. The vulnerability affects multiple Ricoh laser printer and MFP product lines that ship with Web Image Monitor, as documented by JPCERT/CC and Ricoh's own security advisory. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Technical ContextAI
Web Image Monitor is Ricoh's embedded HTTP-based management interface present on a broad range of its laser printer and multifunction printer (MFP) hardware. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the reflected variant - user-supplied input passed in a URL parameter or request is returned in the HTTP response without adequate output encoding or sanitization. Because the script executes in the browser's context rather than on the printer firmware itself, the CVSS 4.0 vector correctly models zero impact on the vulnerable system (VC:N/VI:N/VA:N) and low subsequent-system impact on the user's browser context (SC:L/SI:L). The affected CPE is cpe:2.3:a:ricoh_company,_ltd.:multiple_laser_printers_and_mfps_which_implement_ricoh_web_image_monitor:*:*:*:*:*:*:*:*, indicating the flaw is in the shared Web Image Monitor application component across the product line rather than a single firmware version.
RemediationAI
Consult the Ricoh security advisory at https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2026-000005 for the exact patched firmware versions applicable to each affected model and apply the vendor-released firmware update. No exact fix version is independently confirmed from the available data, so affected version determination must come directly from Ricoh's advisory. As a compensating control while patching is pending, restrict access to the Web Image Monitor interface at the network level by placing affected printers on a dedicated management VLAN or applying firewall rules to limit HTTP/HTTPS access to the printer's management port (typically TCP 80/443) to trusted administrative hosts only. Disabling Web Image Monitor entirely - if the printer's firmware permits - would eliminate the attack surface but will prevent web-based management. Note that limiting network access does not remediate the underlying flaw and is only a temporary measure; firmware patching remains the definitive fix.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today