Ricoh MFP Security Advisory: CVE-2026-60011/63545/63563 Unauthorized Access and Data Exposure

Vulnerability Overview CVE-2026-60011: Unauthorized access to certain functions of the MFP, possibly due to unauthorized permission settings (CVE-82). CVE-2026-63545: When attempting to print a crafted PDF file, different files stored within the MFP may be inadvertently printed (CVE-89). CVE-2026-63563: The address book can be edited by anyone if the setting to require user authentication for accessing the device's web page is not enabled by default (CVE-1188). Affected Products Digital Full-color Multifunctional System: - BP-71C6/BP-71C56/BP-71C45/BP-71C36/ - BP-71C26/BP-61C36/BP-61C36/BP-61C26/ - BP-51C56/BP-51C54/BP-51C43/BP-41C36/ - BP-41C26 - BP-70C55/BP-70C55/BP-70C45/BP-70C26/ - BP-60C36/BP-60C31/BP-60C26/BP-60C55/ - BP-50C55/BP-50C45/BP-40C36/BP-40C26 - MX-8081 - MX-617L/MX-517L/MX-417L/MX-366U/ - MX-516L/MX-266L/MX-615L/MX-515U/ - MX-415L/MX-365L/MX-265U - BP-30C25 - MX-6170FN/MX-5170FN/MX-4170FN/MX-6170FN/ - MX-5170FN/MX-4170FN - MX-6150FN/MX-5150FN/MX-4150FN/MX-3650FN/ - MX-5150FN/MX-2650FN/MX-6150FN/MX-5150FN/ - MX-4150FN/MX-3650FN/MX-5150FN/MX-2650FN/ - MX-3630FN/MX-2630FN - BP-C533WDBP-C533WR - MX-C306W/MX-C305W - BP-70M90/BP-70M75 - BP-71M65/BP-71M55/BP-71M45 - BP-70M65/BP-70M55/BP-70M45 - MX-M1206/MX-M1056 - MX-M7570/MX-M6570 - MX-M6071/MX-M5071/MX-M6071/MX-M3531 - BP-30M35/BP-30M31/BP-30M26/BP-30M31L - MX-M6070/MX-M5070/MX-M6070 - MX-B455W Digital Multifunctional System (Monochrome): - MX-6540FN - MX-5141FN/MX-4141FN/MX-4340FN - MX-3640FN/MX-3140FN/MX-2640FN - MX-5111FN/MX-5110FN/MX-4111FN/MX-4110FN - MX-3610FN/MX-3110FN/MX-2610FN - MX-C202W - MX-3611FN/MX-3111FN/MX-2312FN/MX-2310FN - MX-C310FN/MX-C3610FN/MX-C3121FN/MX-C310FN/MX-C310M/CX-C380P/CX-C310FN/MX-C3125C - MX-5001FN/MX-5000FN/MX-4101FN/MX-4100FN/MX-3600FN - MX-3100FN/MX-3100FG/MX-2600FN/MX-2600FG - MX-3117FN/MX-2517FN - MX-3514FN/MX-3114FN/MX-2514FN - MX-3112FN/MX-2311FN - MX-2301FN - MX-2020F - MX-M1204/MX-M1054/MX-M904 - MX-M754FN/MX-M654FN - MX-M565FN/MX-M465FN/MX-M365FN - MX-M564FN/MX-M464FN - MX-M356FN/MX-M316FN/MX-M266FN/MX-M316G/MX-M256FN/MX-M316FN/MX-M256FN/ - MX-M316G - MX-M354FN/MX-M314FN/MX-M264FN - MX-B302M/MX-B302M/MX-B302SC - MX-M753/MX-M623 - MX-M503N/MX-M303N/MX-M283N/MX-M502F/MX-M423F/MX-M363F Remediation Countermeasures: - Sharp has released updated firmware to mitigate these vulnerabilities. See Table 1 for specific models and firmware versions. - For the models listed in Table 2, all firmware versions are affected, but firmware support has ended. Please implement the following mitigation measures or consider decommissioning the product or migrating to a successor model. Mitigation measures: - Do not connect the MFP directly to the internet; connect it via a firewall or similar network device. - Restrict access to the device's web page using a password ([System Settings] [Security Settings] [Restrict Device Web Page Access Via Password] (enabled by default)). - Change the default administrator and default user passwords from their factory defaults. - Regularly use the audit log feature to check for suspicious access. References: - SHARP Support page: https://www.sharpusa.com/Information/Info_security_2026-07_01.html - Global: http://global.sharp/products/support/information/security_2026-07_01.html - JPCERT/CC Security Advisory (JVN#I968798877): https://jvn.jp/en/vu/JVNVU968798877 Acknowledgment: - CVE-2026-60011 was discovered via a report from Mohamed Abdelrahim (Cyber 50 Defense). - CVE-2026-63563 was discovered via a report from John Jackson. Affected Models and Firmware Version Status Table 1: Models for which countermeasure firmware is available. Table 2: For the following models, potential impacts 2 and 3 do not apply. Since firmware support for these models has ended, please implement the above mitigation measures or consider decommissioning the product or migrating to a successor model. Steps to Check Firmware Version Select the [Settings] icon on the operation panel. If you are accessing the MFP from a PC, you can access the MFP settings by entering its IP address. Select the [Status] tab. Select [Firmware version]. The 16-character alphanumeric string following "BUNDLE" (two alphanumeric strings connected by an underscore) is the firmware version (e.g., 05102200_20040400).

Goal Reached Thanks to every supporter — we hit 100%!

Ricoh MFP Security Advisory: CVE-2026-60011/63545/63563 Unauthorized Access and Data Exposure