CVE-2025-58422
BaseFortify
Publication date: 2025-09-08
Last updated on: 2025-09-08
Assigner: JPCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ricoh | streamline_nx | 3.5.1 |
| ricoh | streamline_nx | 24r3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-348 | The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects RICOH Streamline NX versions 3.5.1 to 24R3 and involves the possibility for an attacker to perform a man-in-the-middle (MITM) attack. By intercepting and altering HTTP request values, the attacker can tamper with the operation history of the product's management tool, leading to unauthorized modification of operation history data. [1]
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker to alter the operation history data of the RICOH Streamline NX management tool. This results in a loss of data integrity, meaning the recorded operation history could be falsified or manipulated. However, it does not affect confidentiality or availability of the system. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves monitoring for man-in-the-middle attacks that alter HTTP request values to the RICOH Streamline NX management tool. Since the vulnerability exploits unencrypted HTTP traffic, you can detect suspicious HTTP request modifications by capturing and analyzing network traffic using tools like tcpdump or Wireshark. For example, use commands such as 'tcpdump -i <interface> port 80' to capture HTTP traffic and inspect for unexpected changes in operation history related requests. Additionally, checking for the use of unencrypted HTTP instead of HTTPS in communications to the management tool can help identify exposure. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating RICOH Streamline NX to the latest version provided by Ricoh, as updates address the vulnerability. Additionally, enabling HTTPS for all communications with the management tool is recommended to encrypt traffic and prevent interception and tampering by attackers performing man-in-the-middle attacks. [1]