Sharp Corporation vulnerabilities, page 2
47 vulnerabilities
Known vulnerabilities in Sharp Corporation products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 30 products.
CVE-2024-58388sharp corporationmultiple multifunction printers+1
EPSS score0.81%
Sharp (and Toshiba Tec rebranded) multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbitrary files by manipulating the path parameter in the installed_emanual_down.html endpoint. Attackers can supply directory traversal sequences such as path=/manual/../../../<path> to access files outside the intended manual directory, including /etc/passwd, coredump files containing credentials, and system configuration files. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30.CVE-2024-29978sharp corporationmultiple mfps (multifunction printers)+1EPSS score1.25%
User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].CVE-2024-29146sharp corporationmultiple mfps (multifunction printers)+1EPSS score0.83%
User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].CVE-2024-46873sharp corporationhome 5g hr02+5EPSS score0.74%
Multiple SHARP routers leave the hidden debug function enabled. An arbitrary OS command may be executed with the root privilege by a remote unauthenticated attacker.CVE-2024-45842sharp corporationsharp digital full-color mfps and monochrome mfps+323EPSS score0.55%
Sharp and Toshiba Tec MFPs improperly process URI data in HTTP PUT requests resulting in a path Traversal vulnerability.
Unintended internal files may be retrieved when processing crafted HTTP requests.CVE-2024-45721sharp corporationhome 5g hr02+2EPSS score1.20%
home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the HOST name configuration screen. An arbitrary OS command may be executed with the root privilege by an administrative user.CVE-2024-45829sharp corporationsharp digital full-color mfps and monochrome mfps+323EPSS score0.71%
Sharp and Toshiba Tec MFPs provide the web page to download data, where query parameters in HTTP requests are improperly processed and resulting in an Out-of-bounds Read vulnerability.
Crafted HTTP requests may cause affected products crashed.CVE-2024-28955sharp corporationmultiple mfps (multifunction printers)+1EPSS score1.31%
Affected devices create coredump files when crashed, storing them with world-readable permission. Any local user of the device can examine the coredump files, and research the memory contents. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].CVE-2024-28038sharp corporationmultiple mfps (multifunction printers)+1EPSS score2.59%
The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More precisely, giving too long character string to MFPSESSIONID parameter results in a stack buffer overflow. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].CVE-2024-32151sharp corporationmultiple mfps (multifunction printers)+1EPSS score1.25%
User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].CVE-2024-34162sharp corporationmultiple mfps (multifunction printers)+1EPSS score0.77%
The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authentication to "SIMPLE", the device communicates with the LDAP server in clear-text. The LDAP password can be retrieved from this clear-text communication. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].CVE-2024-35244sharp corporationmultiple mfps (multifunction printers)+1EPSS score1.06%
There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by examining the coredump), these accounts can be used to re-configure the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].CVE-2024-33616sharp corporationmultiple mfps (multifunction printers)+1EPSS score0.89%
Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege. Sharp Corporation states the telnet feature is implemented on older models only, and is planning to provide the firmware update to remove the feature. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].CVE-2024-33605sharp corporationmultiple mfps (multifunction printers)+1EPSS score6.05%
Improper processing of some parameters of installed_emanual_list.html leads to a path traversal vulnerability. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].CVE-2024-33610sharp corporationmultiple mfps (multifunction printers)+1EPSS score50.45%
"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides logged-in users' session information including session cookies, and "sys_trayentryreboot.html" allows to reboot the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].CVE-2024-23789sharp corporationenergy management controller with cloud services+2EPSS score1.18%
Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary OS command on the affected product.CVE-2024-23785sharp corporationenergy management controller with cloud services+2EPSS score0.36%
Cross-site request forgery vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a remote unauthenticated attacker to change the product settings.CVE-2024-23786sharp corporationenergy management controller with cloud services+2EPSS score0.79%
Cross-site scripting vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary script on the web browser of the user who is accessing the management page of the affected product.CVE-2024-23787sharp corporationenergy management controller with cloud services+2EPSS score0.89%
Path traversal vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to obtain an arbitrary file in the affected product.CVE-2024-23784sharp corporationenergy management controller with cloud services+2EPSS score0.39%
Improper access control vulnerability exists in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier, which may allow a network-adjacent unauthenticated attacker to obtain a username and its hashed password displayed on the management page of the affected product.