CVE-2018-16187

MEDIUM

Ricoh D2200 Firmware < 2.2 - Improper Certificate Validation

Title source: rule
STIX 2.1

Description

The RICOH Interactive Whiteboard D2200 V1.3 to V2.2, D5500 V1.3 to V2.2, D5510 V1.3 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.3 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive Whiteboard Controller Type2 V3.0 to V3.1.10137.0 attached (D5520, D6510, D7500, D8400) does not verify its server certificates, which allows man-in-the-middle attackers to eversdrop on encrypted communication.

References (2)

Core 2
Core References
Third Party Advisory third-party-advisory x_refsource_jvn
https://jvn.jp/en/jp/JVN55263945/index.html
Vendor Advisory x_refsource_misc
https://www.ricoh.com/info/2018/1127_1.html

Scores

CVSS v3 5.9
EPSS 0.0050
EPSS Percentile 39.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-295
Status published
Products (8)
ricoh/d2200_firmware 1.3 - 2.2
ricoh/d5500_firmware 1.3 - 2.2
ricoh/d5510_firmware 1.3 - 2.2
ricoh/d5520_firmware 1.3 - 2.2
ricoh/d6500_firmware 1.3 - 2.2
ricoh/d6510_firmware 1.3 - 2.2
ricoh/d7500_firmware 1.3 - 2.2
ricoh/d8400_firmware 1.3 - 2.2
Published Jan 09, 2019
Tracked Since Feb 18, 2026