RICOH’s Streamline NX firmware versions 3.5.1 through 24R3 contain an improper authorization flaw that allows an attacker able to conduct a man‑in‑the‑middle attack on the device’s communication channel to craft special requests. When these requests are processed, the device may expose the user’s registration data and OIDC tokens. This vulnerability is classified as CWE‑639 and permits disclosure of sensitive credentials without requiring any legitimate local or remote administrative access.

The affected systems are the Ricoh Company, Ltd. RICOH Streamline NX devices running firmware versions 3.5.1 to 24R3.

The flaw carries a CVSS score of 8.2, indicating high severity, but its EPSS score is less than 1%, suggesting that exploitation attempts are currently rare and would need a successful man‑in‑the‑middle position. The vulnerability is not listed in the CISA KEV catalog, indicating that there are no publicly known, actively employed exploits. Attackers would need to intercept traffic between a user and the device, then send crafted requests that bypass the improper authorization checks to retrieve sensitive information.