• Email More Options Modal Window

  • Update: Notice on Ripple20 Treck TCP/IP Stack Potential Vulnerabilities

    Posted on 08-03-2020 06:24 AM
    0 Comments Comments
    https://static.ombe.com/slir/w125/forums/200/rickpics/Ricoh_logo.jpgRicoh is aware of the security vulnerabilities known as the “Ripple20” disclosed by the JSOF on June 16, 2020. These vulnerabilities could potentially allow a remote hacker to trigger an information leak if a specific TCP/IP stack version is used.

    https://www.jsof-tech.com/ripple20/
    https://us-cert.cisa.gov/ics/advisories/icsa-20-168-01

    We have confirmed that Ricoh A3-sized multi-function printers, production printers, digital duplicators, Interactive White Boards, projectors, and Unified Communication Systems do not use IP stack modules from Treck Inc. and Kasago of Zuken Elmic, Inc. The affected printers and A4-sized multi-function printers are confirmed only as following:

    Model Name CVEs
    SP 230SFNw
    SP 230DNw    		 · CVE-2019-12264
    · CVE-2020-11896
    · CVE-2020-11898
    · CVE-2020-11900
    · CVE-2020-11901
    · CVE-2020-11902
    · CVE-2020-11903
    · CVE-2020-11906
    · CVE-2020-11907
    · CVE-2020-11909
    · CVE-2020-11910
    · CVE-2020-11911
    · CVE-2020-11912
    · CVE-2020-11913
    · CVE-2020-11914
    P 201W
    M 340W

    M 340FW (China model)    		 · CVE-2019-12264
    · CVE-2020-11896
    · CVE-2020-11898
    · CVE-2020-11900
    · CVE-2020-11901
    · CVE-2020-11902
    · CVE-2020-11903
    · CVE-2020-11906
    · CVE-2020-11907
    · CVE-2020-11909
    · CVE-2020-11910
    · CVE-2020-11911
    · CVE-2020-11912
    · CVE-2020-11913
    · CVE-2020-11914
    Aficio SP 1210N · CVE-2019-12264
    · CVE-2020-11896
    · CVE-2020-11898
    · CVE-2020-11902
    · CVE-2020-11900
    · CVE-2020-11901
    · CVE-2020-11903
    · CVE-2020-11906
    · CVE-2020-11907
    · CVE-2020-11908
    · CVE-2020-11909
    · CVE-2020-11910
    · CVE-2020-11912
    · CVE-2020-11913
    · CVE-2020-11914
    Aficio GX e3300N
    Aficio GX e7700N    		 · CVE-2019-12264
    · CVE-2020-11911
    · CVE-2020-11901
    · CVE-2020-11912
    · CVE-2020-11903
    · CVE-2020-11907
    · CVE-2020-11910

    THE POTENTIAL VULNERABILITY SUMMARY
    The affected printer has potential vulnerabilities which may cause a device stall, memory destruction, and network failure, but won't be exploited by a springboard attack or cause confidential information leakage. Please visit here.

    This vulnerability will not affect devices connected to the customer's network if the network is properly configured against external attacks. Ricoh recommends always using best practices for network protection, including:

    1. When the device is connected to a network, ensure that the network is protected, for example, by a firewall.
    2. Install the device in a secure network where users restrictions are in place.

    RESOLUTION
    Please download the updated firmware as below. Ricoh will release further updated firmware on the driver site as it is available.

    Model Name New Firmware Version Solved CVEs
    Aficio GX e3300N Ver.1.19
    https://support.ricoh.com/bb/html/dr_ut_e/re2/
    model/gxe330/gxe330.htm    		 CVE-2020-11907
    Aficio GX e7700N Ver.1.05
    https://support.ricoh.com/bb/html/dr_ut_e/rc2/
    model/gxe770/gxe770.htm    		 CVE-2020-11907

    The security and integrity of our customers' data and devices remain of utmost importance to Ricoh and will publish additional advisories for any other affected models, when applicable.

    For further details on best practices for securely setting up your printer or MFP, please visit here.

    |About Ricoh|

    Ricoh is empowering digital workplaces using innovative technologies and services enabling individuals to work smarter. For more than 80 years, Ricoh has been driving innovation and is a leading provider of document management solutions, IT services, communications services, commercial and industrial printing, digital cameras, and industrial systems.
    Headquartered in Tokyo, Ricoh Group operates in approximately 200 countries and regions. In the financial year ended March 2020, Ricoh Group had worldwide sales of 2,008 billion yen (approx. 18.5 billion USD).
    For further information, please visit www.ricoh-europe.com

    For further information, please contact:
    Ricoh Europe PLC
    Jack Gibson
    Tel: +44 (0) 203 033 3766
    E-mail: media@ricoh-europe.com
    Homepage: www.ricoh-europe.com
    Join us on Facebook: www.facebook.com/ricoheurope
    Follow us on Twitter: www.twitter.com/ricoheurope
    Follow us on LinkedIn: http://linkedin.com/company/ricoh-europe
    Visit the Ricoh media centre at: www.ricoh-europe.com/press