CVE-2024-36480 - Vulnerability Details - OpenCVE

Use of hard-coded credentials issue exists in Ricoh Streamline NX PC Client ver.3.7.2 and earlier. If this vulnerability is exploited, an attacker may obtain LocalSystem Account of the PC where the product is installed. As a result, unintended operations may be performed on the PC.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Ricoh	Streamline Nx Pc Client

No data.

No data.

References

Link	Providers
https://jvn.jp/en/jp/JVN00442488/
https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2024-000005

History

No history.

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2024-06-19T06:40:46.619Z

Updated: 2024-08-02T03:37:05.325Z

Reserved: 2024-06-04T09:09:47.217Z

Link: CVE-2024-36480

Vulnrichment

Updated: 2024-07-19T19:38:16.861Z

NVD

Status : Awaiting Analysis

Published: 2024-06-19T07:15:46.340

Modified: 2024-11-21T09:22:15.850

Link: CVE-2024-36480

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-36480", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2024-06-04T09:09:47.217Z", "datePublished": "2024-06-19T06:40:46.619Z", "dateUpdated": "2024-08-02T03:37:05.325Z"}, "containers": {"cna": {"affected": [{"vendor": "CVE-2024-36480", "product": "Ricoh Streamline NX PC Client", "versions": [{"version": "ver.3.7.2 and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Use of hard-coded credentials issue exists in Ricoh Streamline NX PC Client ver.3.7.2 and earlier. If this vulnerability is exploited, an attacker may obtain LocalSystem Account of the PC where the product is installed. As a result, unintended operations may be performed on the PC."}], "problemTypes": [{"descriptions": [{"description": "Use of Hard-coded Credentials", "lang": "en", "type": "text"}]}], "references": [{"url": "https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2024-000005"}, {"url": "https://jvn.jp/en/jp/JVN00442488/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-06-19T06:40:46.619Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-798", "lang": "en", "description": "CWE-798 Use of Hard-coded Credentials"}]}], "affected": [{"vendor": "ricoh", "product": "streamline_nx_pc_client", "cpes": ["cpe:2.3:a:ricoh:streamline_nx_pc_client:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.7.2", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-07-23T19:05:15.770286Z", "id": "CVE-2024-36480", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-23T19:05:23.166Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:37:05.325Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2024-000005", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN00442488/", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-36480", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-07-23T19:05:15.770286Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:ricoh:streamline_nx_pc_client:*:*:*:*:*:*:*:*"], "vendor": "ricoh", "product": "streamline_nx_pc_client", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.7.2"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-19T19:38:16.861Z"}}], "cna": {"affected": [{"vendor": "CVE-2024-36480", "product": "Ricoh Streamline NX PC Client", "versions": [{"status": "affected", "version": "ver.3.7.2 and earlier"}]}], "references": [{"url": "https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2024-000005"}, {"url": "https://jvn.jp/en/jp/JVN00442488/"}], "descriptions": [{"lang": "en", "value": "Use of hard-coded credentials issue exists in Ricoh Streamline NX PC Client ver.3.7.2 and earlier. If this vulnerability is exploited, an attacker may obtain LocalSystem Account of the PC where the product is installed. As a result, unintended operations may be performed on the PC."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Use of Hard-coded Credentials"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-06-19T06:40:46.619Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36480", "state": "PUBLISHED", "dateUpdated": "2024-07-23T19:05:23.166Z", "dateReserved": "2024-06-04T09:09:47.217Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2024-06-19T06:40:46.619Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}