Image Scanner Driver for Linux Command Injection and Link Following

OS command injection in the PFU Limited Image Scanner Driver for Linux (both the fi series and sp series packages) allows a user who already holds a valid login on the affected host to execute arbitrary operating-system commands, potentially at the privilege level of the driver or its helper processes. Exploitation is not remote and not trivial: the assessed vector (AV:L/AC:H/PR:L/UI:R) and the vendor's own wording that the attacker must make 'certain preparations' indicate that a local account plus staging of specific conditions, and possibly a triggering scan-related action by another user, are prerequisites. No public exploit identified at time of analysis and no CISA KEV listing was present in the supplied intelligence, so this is assessed as a genuinely moderate rather than high priority issue - the confidentiality, integrity and availability impact is high where it is successfully triggered, but the local-access and high-complexity gates sharply limit realistic exposure.

Arbitrary file overwrite in the PFU/Ricoh Image Scanner Driver for Linux (fi series and sp series) lets an authenticated local user destroy or corrupt files that the driver's privileged operation writes to, by pre-positioning a symbolic link that the driver later follows. The vendor rates this CVSS 4.0 5.2 (AV:L/AC:L/AT:N/PR:L/UI:P), and our independent CVSS 3.1 assessment is AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H - a local-only integrity and availability issue with no confidentiality impact and no remote or unauthenticated path. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exposure is limited to Linux hosts that actually have this specific PFU/Ricoh scanner driver installed.