CVE-2026-101040 in SP 330DN
Summary
by MITRE • 09/28/2026
A security flaw has been discovered in Ricoh SP 330DN, SP 221, SP C252SF and Aficio SP 3500SF up to 20260813. This affects an unknown part of the component HTTP Multipart Form-Data Parser. Performing a manipulation results in denial of service. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/28/2026
A critical vulnerability affecting multiple Ricoh printer models, including the SP 330DN, SP 221, SP C252SF, and Aficio SP 3500SF with firmware versions up to 20260813, has been identified within the HTTP Multipart Form-Data Parser component. This flaw represents a significant security risk as it allows for remote exploitation without requiring user interaction or authentication in many deployment scenarios. The core technical issue lies in how the device processes incoming multipart form data via Hypertext Transfer Protocol requests. When an attacker sends specially crafted, malformed, or excessively large HTTP POST requests containing manipulated boundary markers or content headers, the parser fails to handle these inputs correctly. This failure typically manifests as a memory corruption error, such as a buffer overflow or heap exhaustion, which destabilizes the internal state of the network service handling web-based management interfaces or print job submissions.
The operational impact of this vulnerability is primarily focused on availability rather than confidentiality or integrity in its current known manifestation. Specifically, successful exploitation leads to a denial of service condition where the affected printer becomes unresponsive and may require a hard power cycle to restore functionality. For organizations relying on these devices for continuous document processing workflows, such outages can disrupt business operations significantly. Since the vulnerability exists within a network-facing component accessible via standard HTTP ports, an attacker positioned anywhere with network connectivity to the device subnet can attempt this attack. The fact that public exploits have been released further exacerbates the risk landscape, as it lowers the barrier to entry for malicious actors who may not possess advanced reverse engineering skills but seek quick disruption or leverage against vulnerable infrastructure.
From a classification perspective, this vulnerability aligns with Common Weakness Enumeration (CWE) identifiers such as CWE-400 Uncontrolled Resource Consumption and potentially CWE-125 Out-of-bounds Read if the parsing logic involves memory access violations leading to crashes. In terms of offensive security frameworks like MITRE ATT&CK, this behavior is consistent with techniques used in resource exhaustion attacks aimed at disrupting service availability. The lack of a vendor response despite early notification indicates a potential gap in Ricoh’s vulnerability management and coordinated disclosure processes for these specific legacy or mid-range device lines. This absence of an official patch leaves administrators without a direct software fix to mitigate the flaw, forcing them to rely on compensating controls until such time as the manufacturer addresses the issue.
To mitigate this risk in the interim, network segmentation is strongly recommended. Administrators should ensure that the management interfaces and print services of these Ricoh devices are not exposed directly to untrusted networks or the public internet. Implementing strict firewall rules to restrict access to these ports only from authorized administrative subnets can significantly reduce the attack surface. Additionally, enabling authentication on all web-based administration pages where possible adds a layer of defense in depth, although it may not fully prevent denial-of-service attempts if the vulnerability triggers before full session validation occurs. Regular monitoring for unusual network traffic patterns targeting HTTP services on these devices can also aid in early detection of exploitation attempts. Organizations should prioritize updating firmware to any newer versions released after 20260813 that might address this parsing logic, and engage directly with Ricoh support again to request an urgent patch or workaround given the public availability of exploits.