What’s Vulnerable › Vulnerabilities

CVE-2022-37406

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-12-07 · updated 2026-06-17
• Weakness: CWE-79

Description

Cross-site scripting vulnerability in Aficio SP 4210N firmware versions prior to Web Support 1.05 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script.

Affected products

• RICOH COMPANY, LTD. Aficio SP 4210N: before 1.05 — fixed in 1.05

How to fix

Upgrade to a fixed version: RICOH COMPANY, LTD. Aficio SP 4210N 1.05. Check the vendor advisory for mitigations.

References

• https://jvn.jp/en/jp/JVN24659622/index.html
• https://support.ricoh.com/bb/html/dr_ut_e/rc3/model/sp42/sp42.htm
• https://support.ricoh.com/bbv2/html/dr_ut_d/ipsio/history/w/bb/pub_j/dr_ut_d/4101044/4101044791/V101/5236968/redirect_CLUTool_DOM/history.htm
• https://jvn.jp/en/jp/JVN24659622/index.html
• https://support.ricoh.com/bb/html/dr_ut_e/rc3/model/sp42/sp42.htm
• https://support.ricoh.com/bbv2/html/dr_ut_d/ipsio/history/w/bb/pub_j/dr_ut_d/4101044/4101044791/V101/5236968/redirect_CLUTool_DOM/history.htm

Get alerted when CVE-2022-37406 or the next vulnerability affects your stack