CVE-2019-7751

published 2019-12-31

CVE-2019-7751: A directory traversal and local file inclusion vulnerability in FPProducerInternetServer.exe in Ricoh MarcomCentral, formerly PTI Marketing, FusionPro VDP…

Priority P2 62 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

A directory traversal and local file inclusion vulnerability in FPProducerInternetServer.exe in Ricoh MarcomCentral, formerly PTI Marketing, FusionPro VDP before 10.0 allows a remote attacker to list or enumerate sensitive contents of files. Furthermore, this could allow for privilege escalation by dumping the local machine's SAM and SYSTEM database files, and possibly remote code execution.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
ricoh	fusionpro_vdp	< 10.0	10.0

Detection & IOCs extracted from sources · hover to see the quote

filename FPProducerInternetServer.exe↗

path C:\Windows\SysWOW64\FPProducerInternetServer.exe↗

port 8080↗

path /Windows/System32/drivers/etc/hosts↗

• → Monitor HTTP GET requests to port 8080 on hosts running FusionPro VDP Creator for path traversal patterns targeting sensitive Windows files (e.g. /windows/system32/, /windows/system32/config/SAM, /windows/system32/config/SYSTEM). Forward slashes are used instead of backslashes. ↗
• → Alert on attempts to retrieve SAM and SYSTEM database files via the FPProducerInternetServer.exe service, as these can be used for privilege escalation or credential dumping. ↗
• → Check for the presence and running state of the Windows service named 'FusionPro Internet Request Handler' as an indicator of an exposed vulnerable endpoint. ↗

• · Versions 10.0 and 10.1 may also be affected despite vendor claims of access restrictions since v9.3; do not assume patched status based solely on version number. ↗

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22