Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-36403: Untrusted search path vulnerability in the installer of Device Software Manager prior to Ver.2.20.3.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

CVE-2022-36403 · published 4 years ago

Summary

Untrusted search path vulnerability in the installer of Device Software Manager prior to Ver.2.20.3.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

What to do

Update ricoh device_software_manager to version 2.20.3.0 or later.

Affected software

Vendor	Product	Affected versions
ricoh	device_software_manager	< 2.20.3.0 `cpe:2.3:a:ricoh:device_software_manager::::::::`

Original advisory text

Untrusted search path vulnerability in the installer of Device Software Manager prior to Ver.2.20.3.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

References

https://jvn.jp/en/jp/JVN44721267/index.html Third Party Advisory
https://www.ricoh.com/software/dev_soft_manager Product

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-426Untrusted Search Path

Timeline

Published8 Sep 2022

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2022-36403 · NVD

Track software like this

Free during beta