EUVD-2026-47876
GHSA-5wcj-6pch-ghh8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L over PR:N because SSH requires authentication; S:C and C:L reflect lateral reachability to LAN hosts with no integrity or availability impact.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
2DescriptionCVE.org
Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. do not implement restrictions on SSH port forwarding, allowing to connect to arbitrary destinations. When SSH is enabled on an affected product, SSH port forwarding may be leveraged to connect to other node on the LAN.
AnalysisAI
Unrestricted SSH port forwarding on Ricoh printers and Multifunction Printers (MFPs) allows network-accessible devices to be used as pivot points into the local area network. When SSH is enabled on an affected device, any party able to establish an SSH connection can forward TCP traffic to arbitrary hosts and ports on the internal LAN, effectively bypassing network segmentation. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the network scope change (S:C in CVSS) reflects that impact extends beyond the printer itself to other internal hosts.
Technical ContextAI
SSH port forwarding (tunneling) is a standard SSH protocol feature permitting TCP connections to be relayed through an authenticated SSH session to other hosts. CWE-923 (Improper Restriction of Communication Channel to Intended Endpoints) describes the root cause: the Ricoh SSH implementation does not apply access controls to limit which destination hosts or ports can be targeted by forwarding requests. The affected CPE (cpe:2.3:a:ricoh_company:ricoh_printers_and_multifunction_printers_(mfps):*:*:*:*:*:*:*:*) covers all versions of the product line with no upper bound, suggesting the flaw is architectural rather than version-specific. Because enterprise MFPs are routinely placed on internal LAN segments with access to file servers, email relays, and other networked infrastructure, an unrestricted forwarding channel through them is a meaningful lateral movement vector.
RemediationAI
The primary remediation is to disable SSH entirely on affected Ricoh devices unless it is operationally required; this eliminates the attack surface completely. If SSH must remain enabled for administrative purposes, restrict SSH access using network access controls (firewall rules or VLAN segmentation) to limit which hosts can initiate SSH sessions to the printer, preventing external or untrusted network segments from reaching it. Additionally, configure SSH server settings on the device - if the firmware permits - to disable TCP port forwarding (typically via AllowTcpForwarding no); however, the vendor advisory at https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2026-000006 should be consulted to confirm whether a firmware patch that enforces this restriction is available and which specific models are covered. Patch availability has not been independently confirmed from the provided references; refer to the vendor advisory for current remediation status and exact fix versions.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today