CVE-2022-36403

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-09-08 · updated 2026-06-17
Weakness: CWE-426

Description

Untrusted search path vulnerability in the installer of Device Software Manager prior to Ver.2.20.3.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

Affected products

RICOH COMPANY, LTD. Installer of Device Software Manager: before 2.20.3.0 — fixed in 2.20.3.0

How to fix

Upgrade to a fixed version: RICOH COMPANY, LTD. Installer of Device Software Manager 2.20.3.0. Check the vendor advisory for mitigations.

References

https://jvn.jp/en/jp/JVN44721267/index.html
https://www.ricoh.com/software/dev_soft_manager
https://jvn.jp/en/jp/JVN44721267/index.html
https://www.ricoh.com/software/dev_soft_manager

Get alerted when CVE-2022-36403 or the next vulnerability affects your stack