Update: Notice on Ripple20 Treck TCP/IP Stack Potential Vulnerabilities
First published July 8, 2020
Date of current status January 7,2021
Ricoh Company, Ltd.
Ricoh is aware of the security vulnerabilities known as the “Ripple20” disclosed by the JSOF on June 16, 2020. These vulnerabilities could potentially allow a remote hacker to trigger an information leak if a specific TCP/IP stack version is used.
https://www.jsof-tech.com/ripple20/
https://www.us-cert.gov/ics/advisories/icsa-20-168-01
Model Name | CVEs |
SP 230SFNw SP 230DNw |
|
P 201W M 340W M 340FW (China model) |
|
Aficio SP 1210N |
|
Aficio GX e3300N Aficio GX e7700N |
|
THE POTENTIAL VULNERABILITY SUMMARY
- When the device is connected to a network, ensure that the network is protected, for example, by a firewall.
- Install the device in a secure network where users restrictions are in place.
RESOLUTION
Please download the updated firmware as below. Ricoh will release further updated firmware on the driver site as it is available.
Model Name | New Firmware Version | Solved CVEs |
Aficio GX e3300N | Ver.1.19 https://support.ricoh.com/bb/html/dr_ut_e/re2/model/gxe330/gxe330.htm |
|
Aficio GX e7700N | Ver.1.05*1 https://support.ricoh.com/bb/html/dr_ut_e/rc2/model/gxe770/gxe770.htm | |
SP 230SFNw
SP 230DNw | Ver.1.05*2 https://support.ricoh.com/bb_v1oi/pub_e/oi/0001075/0001075678/VM0CA861X/M0CA8622_en.pdf |
|
M 340W
M 340FW P 201W (China Model) | Ver.1.01*2 https://support.ricoh.com/bb_v1oi/pub_e/oi/0001081/0001081286/VM0DA8706_01/M0DA8706_cn.pdf Note: The above firmware update guide is applied for P 201W as well. |
|
*2) updated September 25, 2020