{"id":"CVE-2024-36480","state":"PUBLISHED","title":"Use of hard-coded credentials issue exists in Ricoh Streamline NX PC Client ver.3.7.2 and earlier. If this vulnerability is exploited, an attacker may obtain LocalSystem Account of","description":"Use of hard-coded credentials issue exists in Ricoh Streamline NX PC Client ver.3.7.2 and earlier. If this vulnerability is exploited, an attacker may obtain LocalSystem Account of the PC where the product is installed. As a result, unintended operations may be performed on the PC.","publishedAt":"2024-06-19T06:40:46.619Z","updatedAt":"2024-08-02T03:37:05.325Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"jpcert","products":["CVE-2024-36480 Ricoh Streamline NX PC Client"],"affected":[{"vendor":"CVE-2024-36480","product":"Ricoh Streamline NX PC Client","versions":[{"version":"ver.3.7.2 and earlier","status":"affected"}]}],"references":["https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2024-000005","https://jvn.jp/en/jp/JVN00442488/"],"weaknesses":["CWE-798"],"ingestedAt":"2026-10-29T20:07:30.303Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/36xxx/CVE-2024-36480.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-36480","state":"PUBLISHED","datePublished":"2024-06-19T06:40:46.619Z","dateUpdated":"2024-08-02T03:37:05.325Z","assignerShortName":"jpcert","assignerOrgId":"ede6fdc4-6654-4307-a26d-3331c018e2ce","dateReserved":"2024-06-04T09:09:47.217Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Use of hard-coded credentials issue exists in Ricoh Streamline NX PC Client ver.3.7.2 and earlier. If this vulnerability is exploited, an attacker may obtain LocalSystem Account of the PC where the product is installed. As a result, unintended operations may be performed on the PC."}],"affected":[{"vendor":"CVE-2024-36480","product":"Ricoh Streamline NX PC Client","versions":[{"version":"ver.3.7.2 and earlier","status":"affected"}]}],"references":[{"url":"https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2024-000005"},{"url":"https://jvn.jp/en/jp/JVN00442488/"}],"problemTypes":[{"descriptions":[{"description":"Use of Hard-coded Credentials","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"jpcert","orgId":"ede6fdc4-6654-4307-a26d-3331c018e2ce","dateUpdated":"2024-06-19T06:40:46.619Z"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"ricoh","product":"streamline_nx_pc_client","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.7.2","versionType":"custom"}],"cpes":["cpe:2.3:a:ricoh:streamline_nx_pc_client:*:*:*:*:*:*:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-07-23T19:05:15.770286Z","id":"CVE-2024-36480","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-798","type":"CWE","lang":"en","description":"CWE-798 Use of Hard-coded Credentials"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-23T19:05:23.166Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2024-000005","tags":["x_transferred"]},{"url":"https://jvn.jp/en/jp/JVN00442488/","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T03:37:05.325Z"}}]}}}