{"id":"CVE-2019-14299","aliases":["EUVD-2019-5526","GHSA-qv68-78wh-33xr","SUSE-SU-2020:3474-1"],"status":"published","title":"Ricoh SP C250DN 1.05 devices have an Authentication Method Vulnerable to Brute Force Attacks....","description":"Ricoh SP C250DN 1.05 devices have an Authentication Method Vulnerable to Brute Force Attacks. Some Ricoh printers did not implement account lockout. Therefore, it was possible to obtain the local account credentials by brute force.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01408,"percentile":0.72818,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-307"],"published":"2020-03-13T18:50:21Z","modified":"2026-06-17T02:18:09Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.07-12.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"u-boot-rpi3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.07-12.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.07-12.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"u-boot-rpi3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.07-12.3.1"}]}],"bundled":17}],"products":[{"vendor":"ricoh","product":"sp_c250dn_firmware"},{"vendor":"ricoh","product":"sp_c250sf_firmware"},{"vendor":"ricoh","product":"sp_c252dn_firmware"},{"vendor":"ricoh","product":"sp_c252sf_firmware"}],"references":[{"url":"https://www.ricoh-usa.com/en/support-and-download","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-ricoh-printers/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14299"},{"url":"https://github.com/advisories/GHSA-qv68-78wh-33xr"},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203474-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1134157","tags":["report"]},{"url":"https://bugzilla.suse.com/1134853","tags":["report"]},{"url":"https://bugzilla.suse.com/1143463","tags":["report"]},{"url":"https://bugzilla.suse.com/1143777","tags":["report"]},{"url":"https://bugzilla.suse.com/1143817","tags":["report"]},{"url":"https://bugzilla.suse.com/1143818","tags":["report"]},{"url":"https://bugzilla.suse.com/1143819","tags":["report"]},{"url":"https://bugzilla.suse.com/1143820","tags":["report"]},{"url":"https://bugzilla.suse.com/1143821","tags":["report"]},{"url":"https://bugzilla.suse.com/1143823","tags":["report"]},{"url":"https://bugzilla.suse.com/1143824","tags":["report"]},{"url":"https://bugzilla.suse.com/1143825","tags":["report"]},{"url":"https://bugzilla.suse.com/1143827","tags":["report"]},{"url":"https://bugzilla.suse.com/1143828","tags":["report"]},{"url":"https://bugzilla.suse.com/1143830","tags":["report"]},{"url":"https://bugzilla.suse.com/1143831","tags":["report"]},{"url":"https://bugzilla.suse.com/1167209","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14299","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10648","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-14299","description":"Ricoh SP C250DN 1.05 devices have an Authentication Method Vulnerable to Brute Force Attacks. Some Ricoh printers did not implement account lockout. Therefore, it was possible to obtain the local account credentials by brute force.","status":"published","published":"2020-03-13T18:50:21Z","modified":"2024-08-05T00:12:43.282Z","updated_at":"2026-11-02T14:20:17.722148Z"}],"euvd":[{"id":"EUVD-2019-5526","description":"Ricoh SP C250DN 1.05 devices have an Authentication Method Vulnerable to Brute Force Attacks. Some Ricoh printers did not implement account lockout. Therefore, it was possible to obtain the local account credentials by brute force.","status":"published","published":"2020-03-13T18:50:21Z","modified":"2024-08-05T00:12:43Z","updated_at":"2026-11-03T02:40:40.053391Z"}],"ghsa":[{"id":"GHSA-qv68-78wh-33xr","title":"Ricoh SP C250DN 1.05 devices have an Authentication Method Vulnerable to Brute Force Attacks....","description":"Ricoh SP C250DN 1.05 devices have an Authentication Method Vulnerable to Brute Force Attacks. Some Ricoh printers did not implement account lockout. Therefore, it was possible to obtain the local account credentials by brute force.","status":"published","published":"2022-05-24T17:11:26Z","modified":"2023-01-29T05:01:51Z","updated_at":"2026-11-02T14:44:55.873032Z"}],"nvd":[{"id":"CVE-2019-14299","description":"Ricoh SP C250DN 1.05 devices have an Authentication Method Vulnerable to Brute Force Attacks. Some Ricoh printers did not implement account lockout. Therefore, it was possible to obtain the local account credentials by brute force.","status":"published","published":"2020-03-13T19:15:16.697Z","modified":"2026-06-17T02:18:09.107Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T14:05:45.254119Z"}],"osv":[{"id":"SUSE-SU-2020:3474-1","title":"Security update for u-boot","description":"This update for u-boot fixes the following issues:\n\nWork around CVE-2019-11059 by disabling 64Bit descritptor size (bsc#1134853)\n\nCVE-2019-11690 (bsc#1134157), CVE-2020-10648 (bsc#1167209), CVE-2019-13103 (bsc#1143463),\nCVE-2019-14197 (bsc#1143821), CVE-2019-14200 (bsc#1143825), CVE-2019-14201 (bsc#1143827),\nCVE-2019-14202 (bsc#1143828), CVE-2019-14203 (bsc#1143830), CVE-2019-14204 (bsc#1143831),\nCVE-2019-14194 (bsc#1143818), CVE-2019-14198 (bsc#1143823), CVE-2019-14195 (bsc#1143819),\nCVE-2019-14196 (bsc#1143820), CVE-2019-14299 (bsc#1143824), CVE-2019-14192 (bsc#1143777),\nCVE-2019-14193 (bsc#1143817).\n","status":"published","published":"2020-11-20T18:09:59Z","modified":"2026-02-04T02:54:08.494355Z","updated_at":"2026-11-02T15:53:48.11786Z"}]}}