Vulnerabilities with Printers

[JTejada]

Hi,

We are currently working with a client who owns a Ricoh printer and has reported the presence of certain vulnerabilities affecting the device.

We would appreciate it if you could share what measures have been taken to address and resolve these issues. Additionally, we are interested in understanding what proactive steps can be implemented to prevent similar vulnerabilities from occurring in the future.

Your guidance and recommendations will be highly valuable in helping us support our client effectively.

Best regards,

[Mloraditch]

I'm not sure what you are asking about that involves Meraki? This seems to have been intended for a printing related forum.

[alemabrahao · Accepted solution]

I suggest you update your printer's firmware.

This isn't something related to Meraki.

[RWelch]

While I am not aware of Ricoh brand printers there are a few considerations or best practices that can apply to most any printer brand:

update firmware to current release; if device(s) are end of life remove them from service

disable unused service (FTP, Telnet, SNMPv1)

change default password

Things you can do leveraging Meraki (normally part of the network design phase)

use network segmentation (dedicated VLAN for printers / IoT devices)

use L3/L7 rules to allow/deny what devices can connect to the dedicated VLAN

block internet access to these devices (you might need to temporarily allow access for updates then block internet access once updates are completed).

If you happen to have advanced license turn on IDS/IPS and content filtering and look for any activity using security center.

[PhilipDAth]

For more sensitive customers, I put printers onto their own VLAN (along with all IoT devices).

Prevent that VLAN from talking to the internal VLANs.

You can also probably create a firewall rule to deny the printers from talking to anything.

[cmr]

!00% what @PhilipDAth says.  All IoT equipment, such as printers, smart lights, door access control, CCTV (non Meraki) etc. should be placed in separate VLANs and access from those VLANs to other VLANs should be minimised. Access from those VLANs to the internet should also be minimised.

It does take a little extra time to set up, but is well worth it in terms of reducing the attack surface of your site(s) and the possibility of data exfiltration by likely unmonitored devices.