Printer
Monthly
Authenticated path traversal in the web management interface of Fujifilm Apeos multifunction devices and printers (including Apeos C4571 firmware 1.1.3 and earlier and Apeos C3567 1.1.3, plus other listed models) lets an attacker who already holds high privileges on the device's admin interface read arbitrary files from the appliance by submitting a crafted request with traversal sequences in an externally supplied parameter. The exposure is access-gated rather than internet-facing: the assessed vector (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) requires adjacent-network reachability to the management UI and administrative credentials, and the impact is confined to confidentiality (file/data disclosure) with no integrity or availability effect. There is no confirmed active exploitation (the CVE is not in CISA KEV) and no public exploit code identified at time of analysis, so the practical risk is moderate and concentrated on organizations whose printer web consoles are reachable from untrusted or flat internal networks.
Denial of service in Ricoh SP 330DN, SP 221, SP C252SF, and Aficio SP 3500SF multifunction printers (firmware through 20260813) allows a network-reachable attacker with low-privilege credentials to hang the device by submitting a crafted multipart/form-data request to the embedded HTTP management interface. The flaw is an improper-resource-handling condition (CWE-404) in the multipart form-data parser that the researcher's PoC describes as an infinite loop, exhausting device resources with no confidentiality or integrity impact. Publicly available exploit code exists and a proof-of-concept script targeting the SP 330DN has been published on GitHub; the vendor did not respond to the disclosure, so no vendor-released patch is identified at time of analysis. This is a confirmed active-exploitability signal in the form of public tooling, but it is not listed in CISA KEV, and the practical exposure is largely limited to attackers on the same LAN or any environment where the printer's management interface is internet-reachable.
Authenticated path traversal in the web management interface of Fujifilm Apeos multifunction devices and printers (including Apeos C4571 firmware 1.1.3 and earlier and Apeos C3567 1.1.3, plus other listed models) lets an attacker who already holds high privileges on the device's admin interface read arbitrary files from the appliance by submitting a crafted request with traversal sequences in an externally supplied parameter. The exposure is access-gated rather than internet-facing: the assessed vector (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) requires adjacent-network reachability to the management UI and administrative credentials, and the impact is confined to confidentiality (file/data disclosure) with no integrity or availability effect. There is no confirmed active exploitation (the CVE is not in CISA KEV) and no public exploit code identified at time of analysis, so the practical risk is moderate and concentrated on organizations whose printer web consoles are reachable from untrusted or flat internal networks.
Denial of service in Ricoh SP 330DN, SP 221, SP C252SF, and Aficio SP 3500SF multifunction printers (firmware through 20260813) allows a network-reachable attacker with low-privilege credentials to hang the device by submitting a crafted multipart/form-data request to the embedded HTTP management interface. The flaw is an improper-resource-handling condition (CWE-404) in the multipart form-data parser that the researcher's PoC describes as an infinite loop, exhausting device resources with no confidentiality or integrity impact. Publicly available exploit code exists and a proof-of-concept script targeting the SP 330DN has been published on GitHub; the vendor did not respond to the disclosure, so no vendor-released patch is identified at time of analysis. This is a confirmed active-exploitability signal in the form of public tooling, but it is not listed in CISA KEV, and the practical exposure is largely limited to attackers on the same LAN or any environment where the printer's management interface is internet-reachable.