CVE-2026-63226 in Printers
Summary
by MITRE • 07/23/2026
Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. do not implement restrictions on SSH port forwarding, allowing to connect to arbitrary destinations. When SSH is enabled on an affected product, SSH port forwarding may be leveraged to connect to other node on the LAN.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability affects Ricoh printers and multifunction printers that support SSH protocol implementation without proper restrictions on port forwarding capabilities. The flaw resides in the SSH daemon configuration where users can establish arbitrary connections through forwarded ports, effectively bypassing network segmentation controls. This represents a critical security weakness that enables unauthorized lateral movement within local networks. The vulnerability stems from insufficient access control mechanisms within the SSH service implementation, allowing any authenticated user to create port forwardings to internal network resources without proper authorization checks.
The technical exploitation of this vulnerability occurs when an attacker gains access to the printer's SSH service and leverages the available port forwarding options to establish connections to other systems on the same local area network. This capability enables attackers to perform reconnaissance activities, scan internal network services, or even relay credentials to other network nodes that might be protected by firewalls or access control lists. The vulnerability specifically impacts printers running Ricoh's proprietary firmware implementations where SSH daemon configurations lack proper restriction mechanisms for port forwarding operations.
The operational impact of this vulnerability extends beyond simple information disclosure as it provides attackers with a pathway for persistent network reconnaissance and potential privilege escalation within the local network environment. Attackers can use this technique to map internal network topologies, identify other vulnerable devices, or establish footholds for more extensive attacks. The threat is particularly concerning because printers often operate in environments where they have access to sensitive data flows and may be located in areas with relaxed security controls compared to core network infrastructure.
Organizations should implement immediate mitigations including disabling SSH services on affected Ricoh devices when not required, configuring proper firewall rules to restrict access to SSH ports, and implementing network segmentation controls that prevent unauthorized communication between printer networks and sensitive internal systems. Additional protective measures involve monitoring for unusual SSH activity patterns, restricting user accounts with SSH access to only necessary administrative functions, and ensuring that all Ricoh devices receive firmware updates from the vendor addressing this specific port forwarding restriction issue. The vulnerability aligns with CWE-284 which addresses improper access control in network services and represents a technique commonly used in lateral movement tactics described in the MITRE ATT&CK framework under the T1021.004 subtechnique for SSH and Telnet.
This security weakness demonstrates the importance of implementing proper network service restrictions even in peripheral devices that may not traditionally be considered high-risk targets. The vulnerability highlights how seemingly minor configuration oversights in network services can create significant attack vectors within enterprise environments, particularly when considering that many organizations deploy printers with minimal security hardening compared to servers or workstations. The risk is compounded by the fact that printer administrators often have elevated privileges and may not fully understand the implications of SSH port forwarding capabilities on network security posture.