EUVD-2026-88216
GHSA-7hj2-7h7h-f38x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-priv access to printer web interface
-
ExploitSend crafted HTTP multipart/form-data request
-
ExecutionTrigger infinite loop in multipart parser
-
ImpactDevice hangs, printing/scanning unavailable
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource release
|
| Exploitation Conditions | Requires network reachability to the affected Ricoh printer's HTTP interface and low-privilege authentication (PR:L) to submit a crafted multipart/form-data request to the vulnerable parser. Impact is limited to denial of service (device hang/resource exhaustion) with no data exposure or modification. Exploitation is realistically constrained to attackers on the same LAN or environments where the printer's management interface is reachable; internet-exposed printers would broaden exposure. Affects only Ricoh SP 330DN, SP 221, SP C252SF and Aficio SP 3500SF firmware up to 20260813. |
| Impact | This is a low-to-moderate priority denial-of-service issue, not a critical one. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, VA:H with VC:N/VI:N) scores 5.7 and correctly caps impact at availability only - CWE-404 (improper resource handling) manifesting as an infinite loop in the HTTP multipart parser hangs the device but does not expose or alter data. My equivalent CVSS 3.1 assessment (~6.5, A:H only) is slightly higher due to base-score mechanics, but agrees on the availability-only nature. Public exploit code exists (E:P in the vector, confirmed by the GitHub POC), which raises practical exploitability, but there is NO EPSS score provided and NO CISA KEV listing, so there is no evidence of widespread or active exploitation. The signals are internally consistent: modest severity, authenticated (PR:L) attacker on the network, availability-only impact, and a working POC but no exploitation-in-the-wild indicator. Net assessment: real and reproducible, but the DoS-only impact and authentication requirement keep it a low real-world priority absent internet-exposed printer management interfaces. |
| Exploit ScenarioDerived | An attacker with low-privilege access to a Ricoh printer's web/network interface (or on the same office LAN with printer credentials) sends a crafted HTTP multipart/form-data request whose malformed structure drives the parser into an infinite loop. The device becomes unresponsive, halting printing/scanning until rebooted. A public POC (poc.py) demonstrating the infinite loop is available on GitHub, lowering the skill needed to reproduce it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Denial of service in Ricoh SP 330DN, SP 221, SP C252SF, and Aficio SP 3500SF multifunction printers (firmware through 20260813) allows a network-reachable attacker with low-privilege credentials to hang the device by submitting a crafted multipart/form-data request to the embedded HTTP management interface. The flaw is an improper-resource-handling condition (CWE-404) in the multipart form-data parser that the researcher's PoC describes as an infinite loop, exhausting device resources with no confidentiality or integrity impact. Publicly available exploit code exists and a proof-of-concept script targeting the SP 330DN has been published on GitHub; the vendor did not respond to the disclosure, so no vendor-released patch is identified at time of analysis. This is a confirmed active-exploitability signal in the form of public tooling, but it is not listed in CISA KEV, and the practical exposure is largely limited to attackers on the same LAN or any environment where the printer's management interface is internet-reachable.
RemediationAI
No vendor-released patch is identified at time of analysis, because Ricoh was contacted about the disclosure and did not respond, so there is no fixed firmware version to cite. Until a fix appears, the most effective control is to remove reachability to the printers' HTTP management interface: place the devices on a dedicated management VLAN or isolated segment, block inbound TCP access to the embedded web server (typically ports 80/443) at the network boundary, and ensure the printers are never directly internet-exposed, since internet-facing management interfaces materially broaden the attack surface for this and other embedded-device flaws. Change default administrative credentials and eliminate unnecessary low-privilege web accounts, since the assessed vector requires PR:L authentication to reach the parser. If the web UI is required operationally, restrict it to a small set of administrative hosts via firewall allowlists and consider rate-limiting or connection caps on the management service; the trade-off is that administrators lose convenient remote access and must manage devices from designated jump hosts. Disabling unused services that share the embedded web stack (for example remote/WSD printing features) reduces adjacent attack surface but may break legitimate print discovery workflows. Because exploitation causes a hang rather than data loss, a practical incident response is to power-cycle or restart the affected device and then inspect logs for repeated malformed multipart POSTs, which can be used as a detection signature. Monitor the VulDB entry (https://vuldb.com/vuln/410908) and Ricoh's firmware download pages for a corrected release before re-enabling normal network access.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the embedded HTTP server's multipart/form-data parser used by the web management interface of these Ricoh SP-series printers. CWE-404 (Improper Resource Shutdown or Release) is the assigned root-cause class, and the published PoC directory is named 'SP330DN-multipart-parser-infinite-loop', indicating that a malformed or specially structured multipart body drives the parser into a loop that does not terminate, consuming CPU and/or connection resources until the device becomes unresponsive. Because the vulnerable surface is the printer's HTTP management service, the attack requires network reachability to that interface and, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, low-privilege authentication to submit the request. The CVSS 4.0 vector supplied by the CNA (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) is consistent with this: availability-only impact, no scope change, no data read or write. The reference repository path ('vuls-find-VxWorks/blob/main/RICOH/...') reflects the researcher's repository naming rather than the affected device platform, and should not be read as evidence that VxWorks is the vulnerable stack.
Know when Printer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Remote network vector, low complexity, low-privilege authentication (PR:L) per vendor vector; availability-only impact (infinite-loop DoS), no confidentiality or integrity effect, no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A security flaw has been discovered in Ricoh SP 330DN, SP 221, SP C252SF and Aficio SP 3500SF up to 20260813. This affects an unknown part of the component HTTP Multipart Form-Data Parser. Performing a manipulation results in denial of service. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB