CVE-2019-19363
HIGHRicoh Printer Drivers - Local Privilege Escalation via Incorrect Permission Assignment
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2019-19363.
PoCs published by Metasploit, pentagrid, Alexander Pudwill, Pentagrid AG, Shelby Pace, including Metasploit module exploits/windows/local/ricoh_driver_privesc.
AI-analyzed exploit summary This Metasploit module exploits a privilege escalation vulnerability in Ricoh printer drivers by writing a malicious DLL to a vulnerable directory and adding a printer to trigger its execution as SYSTEM.
Description
An issue was discovered in Ricoh (including Savin and Lanier) Windows printer drivers prior to 2020 that allows attackers local privilege escalation. Affected drivers and versions are: PCL6 Driver for Universal Print - Version 4.0 or later PS Driver for Universal Print - Version 4.0 or later PC FAX Generic Driver - All versions Generic PCL5 Driver - All versions RPCS Driver - All versions PostScript3 Driver - All versions PCL6 (PCL XL) Driver - All versions RPCS Raster Driver - All version
Exploits (3)
This Metasploit module exploits a privilege escalation vulnerability in Ricoh printer drivers by writing a malicious DLL to a vulnerable directory and adding a printer to trigger its execution as SYSTEM.
This PoC exploits CVE-2019-19363 by monitoring Ricoh printer driver DLL file changes and overwriting a target DLL with a malicious one before it is loaded, achieving local privilege escalation.
This Metasploit module exploits a privilege escalation vulnerability in Ricoh printer drivers by leveraging insecure directory permissions to plant a malicious DLL, which is then loaded by a SYSTEM process during printer installation.
References (5)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H