Detections
Analytics

Streamline NX Client < 3.4.3.2 / 3.5.x < 3.5.1.202 / 3.6.x < 3.6.2.2 RCE (2024-000004)

medium Nessus Plugin ID 200808

Language:

Synopsis

The remote host is missing a security update.

Description

The version of Streamline NX Client installed on the remote host is prior to 3.231.0, 3.4.3.2, 3.5.1.202 or 3.6.2.2.
It is, therefore, affected by a vulnerability as referenced in the 2024-000004 advisory.

 - Improper restriction of communication channel to intended endpoints issue exists in Ricoh Streamline NX PC Client ver.3.6.x and earlier. If this vulnerability is exploited, arbitrary code may be executed on the PC where the product is installed.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Streamline NX Client version 3.231.0 / 3.4.3.2 / 3.5.1.202 / 3.6.2.2 or later.

See Also

http://www.nessus.org/u?946f6d82

http://www.nessus.org/u?ebc8b722

Plugin Details

Severity: Medium

ID: 200808

File Name: ricoh_streamline_nx_2024-000004.nasl

Version: 1.2

Type: local

Agent: windows

Family: Windows

Published: 6/21/2024

Updated: 6/24/2024

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.4

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 4.3

Vector: CVSS2#AV:A/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2024-36252

CVSS v3

Risk Factor: Medium

Base Score: 6.3

Temporal Score: 5.5

Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:ricoh:streamline_nx_client_tool

Required KB Items: installed_sw/Streamline NX Client

Exploit Ease: No known exploits are available

Patch Publication Date: 6/18/2024

Vulnerability Publication Date: 6/18/2024

Reference Information

CVE: CVE-2024-36252

IAVB: 2024-B-0081