CVE-2025-36506: RICOH Streamline NX Path Traversal Flaw

CVE-2025-36506 Overview

CVE-2025-36506 is an external control of file name or path vulnerability [CWE-73] affecting RICOH Streamline NX V3 PC Client versions 3.5.0 through 3.242.0. An unauthenticated remote attacker can send a specially crafted request that causes the client to write log data to attacker-chosen file paths. The result is arbitrary file overwrite on the target file system, limited to the content the logging subsystem produces. The issue was published to the National Vulnerability Database on June 13, 2025 and coordinated through the Japan Vulnerability Notes (JVN) portal.

Critical Impact
Remote, unauthenticated attackers can overwrite arbitrary files on hosts running vulnerable RICOH Streamline NX V3 PC Client builds, corrupting application binaries, configuration files, or scheduled task definitions.

Affected Products

RICOH Streamline NX V3 PC Client version 3.5.0
RICOH Streamline NX V3 PC Client versions 3.5.1 through 3.241.x
RICOH Streamline NX V3 PC Client version 3.242.0

Discovery Timeline

2025-06-13 - CVE-2025-36506 published to NVD and coordinated through JVN
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36506

Vulnerability Analysis

The RICOH Streamline NX V3 PC Client exposes a network-reachable interface that accepts requests influencing where the client writes log output. Because the client fails to constrain the destination file name or path supplied through that request, an attacker controls the target of the write. The logging routine then opens the attacker-specified path and appends or overwrites its contents with log data.

The primary consequence is integrity loss. An attacker cannot read files, but they can destroy or replace them with logger-formatted content. Overwriting binaries, DLLs, service configuration files, or scheduled task definitions can lead to denial of service or, in specific configurations, code execution when the corrupted file is later loaded by a privileged process. The client typically runs on user workstations that interact with Ricoh multifunction printers, so exposure exists wherever the client listens on the network.

Root Cause

The root cause is missing validation and canonicalization of a file path parameter accepted from a network request. The client does not enforce an allow-list of log destinations, does not restrict writes to a sandboxed directory, and does not reject traversal sequences such as ..\ or absolute paths. This maps to [CWE-73]: External Control of File Name or Path.

Attack Vector

An attacker with network access to a workstation running the vulnerable client sends a crafted request that specifies an attacker-chosen destination path. The client honors the path and writes log data to it under the privileges of the client process. No authentication and no user interaction are required. Exploitation does not require reading server responses, which makes the attack viable across restricted network paths where the attacker can reach the client's listening port.

No public proof-of-concept exploit is currently available. Technical details are coordinated through the JVN Vulnerability Report and the Ricoh Security Advisory.

Detection Methods for CVE-2025-36506

Indicators of Compromise

Unexpected modifications to system binaries, DLLs, or configuration files on hosts running Streamline NX V3 PC Client, particularly files whose contents now include log-formatted timestamps or Streamline log strings.
New or altered files in directories outside the client's normal log path, such as C:\Windows\System32\ or user startup folders.
Streamline NX client process (SLNX* executables) opening file handles to paths outside its installation and log directories.

Detection Strategies

Inventory endpoints running RICOH Streamline NX V3 PC Client and compare installed versions against the affected range 3.5.0 to 3.242.0.
Monitor file-write telemetry for the Streamline NX client process and alert on writes to sensitive directories or to files with executable, script, or configuration extensions.
Inspect network traffic to the client's listening port for unexpected external sources; the client should only receive requests from trusted Streamline NX servers.

Monitoring Recommendations

Enable file integrity monitoring on system directories, scheduled task stores, and application configuration paths on workstations running the client.
Correlate process-to-file-write events so that any write by the Streamline NX client outside its designated log directory generates an alert.
Retain endpoint and network logs long enough to reconstruct the source of any observed overwrite, since the attack leaves log-formatted content in the victim file.

How to Mitigate CVE-2025-36506

Immediate Actions Required

Identify all systems running RICOH Streamline NX V3 PC Client versions 3.5.0 through 3.242.0 and prioritize them for patching.
Restrict network access to the client's listening interface so that only authorized Streamline NX servers can reach it, using host-based firewalls or network segmentation.
Back up critical configuration files and application binaries on affected workstations before remediation to support recovery if overwrite has already occurred.

Patch Information

Ricoh has published fixed versions and remediation guidance in the vendor advisory. Refer to the Ricoh Security Advisory ricoh-2025-000004 for the corrected version numbers and download instructions, and to the JVN Vulnerability Report JVN27937557 for coordinated disclosure details. Apply the fixed release to every affected endpoint.

Workarounds

Block inbound traffic to the Streamline NX V3 PC Client's listening port at the host firewall except from documented, trusted Streamline NX server addresses.
Run the client under a low-privilege account so that any successful path-controlled write cannot reach system-owned files.
If patching must be deferred, disable or uninstall the Streamline NX V3 PC Client on hosts that do not require print-management integration.

bash

# Example: restrict inbound access to Streamline NX client on Windows
# Replace <ServerIP> with the authorized Streamline NX server address
netsh advfirewall firewall add rule ^
  name="Allow Streamline NX Server" ^
  dir=in action=allow ^
  program="C:\Program Files\RICOH\Streamline NX\PC Client\SLNXClient.exe" ^
  remoteip=<ServerIP>

netsh advfirewall firewall add rule ^
  name="Block Streamline NX Client Inbound" ^
  dir=in action=block ^
  program="C:\Program Files\RICOH\Streamline NX\PC Client\SLNXClient.exe"