Search
Find a vulnerability
Search criteria
98 vulnerabilities by Sharp Corporation
CVE-2026-32326 (GCVE-0-2026-32326)
Vulnerability from nvd – Published: 2026-03-25 07:38 – Updated: 2026-03-25 13:26
VLAI
Summary
SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password of the device is left as the initial one, the device may be taken over.
Severity
5.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-306 - Missing authentication for critical function
Assigner
References
2 references
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | home 5G HR01 |
Affected:
38JP_0_490 and earlier
|
|
| Sharp Corporation | home 5G HR02 |
Affected:
S5.A1.00 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-52A |
Affected:
38JP_2_03J and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-52B |
Affected:
S3.87.15 and earlierr
|
|
| Sharp Corporation | Wi-Fi STATION SH-54C |
Affected:
S6.64.00 and earlier
|
|
| Sharp Corporation | 5G Mobile Router SH-U01 |
Affected:
S4.48.00 and earlier
|
|
| Sharp Corporation | Pocket WiFi 5G A503SH |
Affected:
S7.41.00 and earlier
|
|
| Sharp Corporation | Speed Wi-Fi 5G X01 |
Affected:
3RJP_2_03I and earlier
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-32326",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-25T13:26:41.257984Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T13:26:49.064Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "home 5G HR01",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "38JP_0_490 and earlier"
}
]
},
{
"product": "home 5G HR02",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S5.A1.00 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-52A",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "38JP_2_03J and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-52B",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S3.87.15 and earlierr"
}
]
},
{
"product": "Wi-Fi STATION SH-54C",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S6.64.00 and earlier"
}
]
},
{
"product": "5G Mobile Router SH-U01",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S4.48.00 and earlier"
}
]
},
{
"product": "Pocket WiFi 5G A503SH",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S7.41.00 and earlier"
}
]
},
{
"product": "Speed Wi-Fi 5G X01",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "3RJP_2_03I and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password of the device is left as the initial one, the device may be taken over."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing authentication for critical function",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T07:38:20.672Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://global.sharp/corporate/info/product-security/advisory-list/2026-002/"
},
{
"url": "https://jvn.jp/en/jp/JVN49524110/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-32326",
"datePublished": "2026-03-25T07:38:20.672Z",
"dateReserved": "2026-03-12T06:43:35.484Z",
"dateUpdated": "2026-03-25T13:26:49.064Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-54082 (GCVE-0-2024-54082)
Vulnerability from nvd – Published: 2024-12-23 00:18 – Updated: 2024-12-24 00:39
VLAI
Summary
home 5G HR02 and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the configuration restore function. An arbitrary OS command may be executed with the root privilege by an administrative user.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS Command Injection')
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | home 5G HR02 |
Affected:
S5.82.00 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-54C |
Affected:
S6.60.00 and earlier
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-54082",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-24T00:32:44.201878Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-24T00:39:24.102Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "home 5G HR02",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S5.82.00 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-54C",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S6.60.00 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "home 5G HR02 and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the configuration restore function. An arbitrary OS command may be executed with the root privilege by an administrative user."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper neutralization of special elements used in an OS command (\u0027OS Command Injection\u0027)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-23T00:18:12.865Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://k-tai.sharp.co.jp/support/info/info083.html"
},
{
"url": "https://jvn.jp/en/jp/JVN61635834/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-54082",
"datePublished": "2024-12-23T00:18:12.865Z",
"dateReserved": "2024-12-02T06:03:35.297Z",
"dateUpdated": "2024-12-24T00:39:24.102Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-52321 (GCVE-0-2024-52321)
Vulnerability from nvd – Published: 2024-12-23 00:18 – Updated: 2024-12-24 00:39
VLAI
Summary
Multiple SHARP routers contain an improper authentication vulnerability in the configuration backup function. The product's backup files containing sensitive information may be retrieved by a remote unauthenticated attacker.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-497 - Exposure of sensitive system information to an unauthorized control sphere
Assigner
References
2 references
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | home 5G HR02 |
Affected:
S5.82.00 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-52B |
Affected:
S3.87.11 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-54C |
Affected:
S6.60.00 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-05L |
Affected:
01.00.C0 and earlier
|
|
| Sharp Corporation | PocketWifi 809SH |
Affected:
01.00.B9 and earlier
|
|
| Sharp Corporation | Speed Wi-Fi NEXT W07 |
Affected:
02.00.48 and earlier
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-52321",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-24T00:31:17.038246Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-24T00:39:30.331Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "home 5G HR02",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S5.82.00 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-52B",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S3.87.11 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-54C",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S6.60.00 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-05L",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "01.00.C0 and earlier"
}
]
},
{
"product": "PocketWifi 809SH",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "01.00.B9 and earlier"
}
]
},
{
"product": "Speed Wi-Fi NEXT W07",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "02.00.48 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple SHARP routers contain an improper authentication vulnerability in the configuration backup function. The product\u0027s backup files containing sensitive information may be retrieved by a remote unauthenticated attacker."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-497",
"description": "Exposure of sensitive system information to an unauthorized control sphere",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-23T00:18:08.358Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://k-tai.sharp.co.jp/support/info/info083.html"
},
{
"url": "https://jvn.jp/en/jp/JVN61635834/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-52321",
"datePublished": "2024-12-23T00:18:08.358Z",
"dateReserved": "2024-12-02T06:03:32.297Z",
"dateUpdated": "2024-12-24T00:39:30.331Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-47864 (GCVE-0-2024-47864)
Vulnerability from nvd – Published: 2024-12-23 00:18 – Updated: 2024-12-24 00:39
VLAI
Summary
home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain a buffer overflow vulnerability in the hidden debug function. A remote unauthenticated attacker may get the web console of the product down.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-120 - Buffer overflow
Assigner
References
2 references
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | home 5G HR02 |
Affected:
S5.82.00 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-52B |
Affected:
S3.87.11 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-54C |
Affected:
S6.60.00 and earlier
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47864",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-24T00:35:27.338755Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-24T00:39:37.171Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "home 5G HR02",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S5.82.00 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-52B",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S3.87.11 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-54C",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S6.60.00 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain a buffer overflow vulnerability in the hidden debug function. A remote unauthenticated attacker may get the web console of the product down."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "Buffer overflow",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-23T00:18:03.318Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://k-tai.sharp.co.jp/support/info/info083.html"
},
{
"url": "https://jvn.jp/en/jp/JVN61635834/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-47864",
"datePublished": "2024-12-23T00:18:03.318Z",
"dateReserved": "2024-12-02T06:03:34.435Z",
"dateUpdated": "2024-12-24T00:39:37.171Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-46873 (GCVE-0-2024-46873)
Vulnerability from nvd – Published: 2024-12-23 00:17 – Updated: 2024-12-24 00:39
VLAI
Summary
Multiple SHARP routers leave the hidden debug function enabled. An arbitrary OS command may be executed with the root privilege by a remote unauthenticated attacker.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-489 - Active debug code
Assigner
References
2 references
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | home 5G HR02 |
Affected:
S5.82.00 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-52B |
Affected:
S3.87.11 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-54C |
Affected:
S6.60.00 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-05L |
Affected:
01.00.C0 and earlier
|
|
| Sharp Corporation | PocketWifi 809SH |
Affected:
01.00.B9 and earlier
|
|
| Sharp Corporation | Speed Wi-Fi NEXT W07 |
Affected:
02.00.48 and earlier
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46873",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-24T00:35:52.238750Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-24T00:39:44.951Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "home 5G HR02",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S5.82.00 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-52B",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S3.87.11 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-54C",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S6.60.00 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-05L",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "01.00.C0 and earlier"
}
]
},
{
"product": "PocketWifi 809SH",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "01.00.B9 and earlier"
}
]
},
{
"product": "Speed Wi-Fi NEXT W07",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "02.00.48 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple SHARP routers leave the hidden debug function enabled. An arbitrary OS command may be executed with the root privilege by a remote unauthenticated attacker."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-489",
"description": "Active debug code",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-23T00:17:59.216Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://k-tai.sharp.co.jp/support/info/info083.html"
},
{
"url": "https://jvn.jp/en/jp/JVN61635834/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-46873",
"datePublished": "2024-12-23T00:17:59.216Z",
"dateReserved": "2024-12-02T06:03:30.029Z",
"dateUpdated": "2024-12-24T00:39:44.951Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45721 (GCVE-0-2024-45721)
Vulnerability from nvd – Published: 2024-12-23 00:17 – Updated: 2024-12-24 00:39
VLAI
Summary
home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the HOST name configuration screen. An arbitrary OS command may be executed with the root privilege by an administrative user.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS Command Injection')
Assigner
References
2 references
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | home 5G HR02 |
Affected:
S5.82.00 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-52B |
Affected:
S3.87.11 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-54C |
Affected:
S6.60.00 and earlier
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-45721",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-24T00:32:46.849402Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-24T00:39:52.364Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "home 5G HR02",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S5.82.00 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-52B",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S3.87.11 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-54C",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S6.60.00 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the HOST name configuration screen. An arbitrary OS command may be executed with the root privilege by an administrative user."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper neutralization of special elements used in an OS command (\u0027OS Command Injection\u0027)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-23T00:17:55.581Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://k-tai.sharp.co.jp/support/info/info083.html"
},
{
"url": "https://jvn.jp/en/jp/JVN61635834/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-45721",
"datePublished": "2024-12-23T00:17:55.581Z",
"dateReserved": "2024-12-02T06:03:33.501Z",
"dateUpdated": "2024-12-24T00:39:52.364Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-36254 (GCVE-0-2024-36254)
Vulnerability from nvd – Published: 2024-11-26 07:38 – Updated: 2024-11-26 14:48
VLAI
Summary
Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lead to a denial-of-service (DoS) condition.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-bounds read
Assigner
References
Impacted products
51 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Sharp Corporation listed under [References]
|
|
| Toshiba Tec Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Toshiba Tec Corporation listed under [References]
|
|
| sharp | bp-90c70 |
Affected:
0 , ≤ 200
(custom)
cpe:2.3:h:sharp:bp-90c70:-:*:*:*:*:*:*:* |
|
| sharp | bp-90c80 |
Affected:
0 , ≤ 200
(custom)
cpe:2.3:h:sharp:bp-90c80:-:*:*:*:*:*:*:* |
|
| sharp | bp-70c65 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-70c65:-:*:*:*:*:*:*:* |
|
| sharp | bp-70c55 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-70c55:-:*:*:*:*:*:*:* |
|
| sharp | bp-70c45 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-70c45:-:*:*:*:*:*:*:* |
|
| sharp | bp-70c36 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-70c36:-:*:*:*:*:*:*:* |
|
| sharp | bp-70c31 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-70c31:-:*:*:*:*:*:*:* |
|
| sharp | bp-60c45 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-60c45:-:*:*:*:*:*:*:* |
|
| sharp | bp-60c36 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-60c36:-:*:*:*:*:*:*:* |
|
| sharp | bp-60c31 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-60c31:-:*:*:*:*:*:*:* |
|
| sharp | bp-50c65 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-50c65:-:*:*:*:*:*:*:* |
|
| sharp | bp-50c55 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-50c55:-:*:*:*:*:*:*:* |
|
| sharp | bp-50c45 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-50c45:-:*:*:*:*:*:*:* |
|
| sharp | bp-50c36 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-50c36:-:*:*:*:*:*:*:* |
|
| sharp | bp-50c31 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-50c31:-:*:*:*:*:*:*:* |
|
| sharp | bp-50c26 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-50c26:-:*:*:*:*:*:*:* |
|
| sharp | bp-55c26 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-55c26:-:*:*:*:*:*:*:* |
|
| sharp | mx-8081 |
Affected:
0 , ≤ 150
(custom)
cpe:2.3:h:sharp:mx-8081:-:*:*:*:*:*:*:* |
|
| sharp | mx-7081 |
Affected:
0 , ≤ 150
(custom)
cpe:2.3:h:sharp:mx-7081:-:*:*:*:*:*:*:* |
|
| sharp | mx-6071 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-6071:-:*:*:*:*:*:*:* |
|
| sharp | mx-5071 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-5071:-:*:*:*:*:*:*:* |
|
| sharp | mx-4071 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-4071:-:*:*:*:*:*:*:* |
|
| sharp | mx-3571 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-3571:-:*:*:*:*:*:*:* |
|
| sharp | mx-3071 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-3071:-:*:*:*:*:*:*:* |
|
| sharp | mx-4061 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-4061:-:*:*:*:*:*:*:* |
|
| sharp | mx-3561 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-3561:-:*:*:*:*:*:*:* |
|
| sharp | mx-3061 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-3061:-:*:*:*:*:*:*:* |
|
| sharp | mx-6051 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-6051:-:*:*:*:*:*:*:* |
|
| sharp | mx-5051 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-5051:-:*:*:*:*:*:*:* |
|
| sharp | mx-4051 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-4051:-:*:*:*:*:*:*:* |
|
| sharp | mx-3551 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-3551:-:*:*:*:*:*:*:* |
|
| sharp | mx-3051 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-3051:-:*:*:*:*:*:*:* |
|
| sharp | mx-2651 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-2651:-:*:*:*:*:*:*:* |
|
| sharp | mx-6071s |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-6071s:-:*:*:*:*:*:*:* |
|
| sharp | mx-5071s |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-5071s:-:*:*:*:*:*:*:* |
|
| sharp | mx-4071s |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-4071s:-:*:*:*:*:*:*:* |
|
| sharp | mx-3571s |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-3571s:-:*:*:*:*:*:*:* |
|
| sharp | mx-3071s |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-3071s:-:*:*:*:*:*:*:* |
|
| sharp | mx-4061s |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-4061s:-:*:*:*:*:*:*:* |
|
| sharp | mx-3561s |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-3561s:-:*:*:*:*:*:*:* |
|
| sharp | mx-3061s |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-3061s:-:*:*:*:*:*:*:* |
|
| sharp | bp-30c25 |
Affected:
0 , ≤ 123
(custom)
cpe:2.3:h:sharp:bp-30c25:-:*:*:*:*:*:*:* |
|
| sharp | bp-30c25y |
Affected:
0 , ≤ 123
(custom)
cpe:2.3:h:sharp:bp-30c25y:-:*:*:*:*:*:*:* |
|
| sharp | bp-30c25z |
Affected:
0 , ≤ 123
(custom)
cpe:2.3:h:sharp:bp-30c25z:-:*:*:*:*:*:*:* |
|
| sharp | bp-30c25t |
Affected:
0 , ≤ 123
(custom)
cpe:2.3:h:sharp:bp-30c25t:-:*:*:*:*:*:*:* |
|
| sharp | mx-7580n |
Affected:
0 , ≤ 502
(custom)
cpe:2.3:h:sharp:mx-7580n:-:*:*:*:*:*:*:* |
|
| sharp | mx-6580n |
Affected:
0 , ≤ 502
(custom)
cpe:2.3:h:sharp:mx-6580n:-:*:*:*:*:*:*:* |
|
| sharp | mx-8090n |
Affected:
0 , ≤ 404
(custom)
cpe:2.3:h:sharp:mx-8090n:-:*:*:*:*:*:*:* |
|
| sharp | mx-7090n |
Affected:
0 , ≤ 404
(custom)
cpe:2.3:h:sharp:mx-7090n:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:sharp:bp-90c70:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-90c70",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "200",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-90c80:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-90c80",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "200",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-70c65:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-70c65",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-70c55:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-70c55",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-70c45:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-70c45",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-70c36:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-70c36",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-70c31:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-70c31",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-60c45:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-60c45",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-60c36:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-60c36",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-60c31:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-60c31",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-50c65:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-50c65",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-50c55:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-50c55",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-50c45:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-50c45",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-50c36:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-50c36",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-50c31:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-50c31",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-50c26:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-50c26",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-55c26:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-55c26",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-8081:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-8081",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "150",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-7081:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-7081",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "150",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-6071:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-6071",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-5071:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-5071",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-4071:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-4071",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-3571:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-3571",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-3071:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-3071",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-4061:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-4061",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-3561:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-3561",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-3061:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-3061",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-6051:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-6051",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-5051:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-5051",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-4051:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-4051",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-3551:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-3551",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-3051:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-3051",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-2651:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-2651",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-6071s:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-6071s",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-5071s:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-5071s",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-4071s:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-4071s",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-3571s:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-3571s",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-3071s:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-3071s",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-4061s:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-4061s",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-3561s:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-3561s",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-3061s:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-3061s",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-30c25:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-30c25",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "123",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-30c25y:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-30c25y",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "123",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-30c25z:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-30c25z",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "123",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-30c25t:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-30c25t",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "123",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-7580n:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-7580n",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "502",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-6580n:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-6580n",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "502",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-8090n:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-8090n",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "404",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-7090n:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-7090n",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "404",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-36254",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-26T14:24:25.876189Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T14:48:35.480Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Sharp Corporation listed under [References]"
}
]
},
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Toshiba Tec Corporation listed under [References]"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lead to a denial-of-service (DoS) condition."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds read",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T07:38:30.408Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"url": "https://www.toshibatec.com/information/20240531_02.html"
},
{
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU93051062/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-36254",
"datePublished": "2024-11-26T07:38:30.408Z",
"dateReserved": "2024-05-22T09:00:17.089Z",
"dateUpdated": "2024-11-26T14:48:35.480Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-36251 (GCVE-0-2024-36251)
Vulnerability from nvd – Published: 2024-11-26 07:38 – Updated: 2025-11-04 17:21
VLAI
Summary
The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash. More precisely, a crafted parameter to billcodedef_sub_sel.html is not processed properly and device-crash happens. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-bounds read
Assigner
References
7 references
Impacted products
24 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Sharp Corporation listed under [References]
|
|
| Toshiba Tec Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Toshiba Tec Corporation listed under [References]
|
|
| sharp | mx-m905 |
Affected:
611
cpe:2.3:h:sharp:mx-m905:-:*:*:*:*:*:*:* |
|
| sharp | mx-m6070 |
Affected:
502
cpe:2.3:h:sharp:mx-m6070:-:*:*:*:*:*:*:* |
|
| sharp | mx-m5070 |
Affected:
502
cpe:2.3:h:sharp:mx-m5070:-:*:*:*:*:*:*:* |
|
| sharp | mx-m4070 |
Affected:
502
cpe:2.3:h:sharp:mx-m4070:-:*:*:*:*:*:*:* |
|
| sharp | mx-m3570 |
Affected:
502
cpe:2.3:h:sharp:mx-m3570:-:*:*:*:*:*:*:* |
|
| sharp | mx-m3070 |
Affected:
502
cpe:2.3:h:sharp:mx-m3070:-:*:*:*:*:*:*:* |
|
| sharp | mx-m6050 |
Affected:
502
cpe:2.3:h:sharp:mx-m6050:-:*:*:*:*:*:*:* |
|
| sharp | mx-m5050 |
Affected:
502
cpe:2.3:h:sharp:mx-m5050:-:*:*:*:*:*:*:* |
|
| sharp | mx-m4050 |
Affected:
502
cpe:2.3:h:sharp:mx-m4050:-:*:*:*:*:*:*:* |
|
| sharp | mx-m3550 |
Affected:
502
cpe:2.3:h:sharp:mx-m3550:-:*:*:*:*:*:*:* |
|
| sharp | mx-m3050 |
Affected:
502
cpe:2.3:h:sharp:mx-m3050:-:*:*:*:*:*:*:* |
|
| sharp | mx-m2630 |
Affected:
502
cpe:2.3:h:sharp:mx-m2630:-:*:*:*:*:*:*:* |
|
| sharp | bp-b550wd |
Affected:
250
cpe:2.3:h:sharp:bp-b550wd:-:*:*:*:*:*:*:* |
|
| sharp | bp-b540wr |
Affected:
250
cpe:2.3:h:sharp:bp-b540wr:-:*:*:*:*:*:*:* |
|
| sharp | bp-b547wd |
Affected:
250
cpe:2.3:h:sharp:bp-b547wd:-:*:*:*:*:*:*:* |
|
| sharp | bp-b537wr |
Affected:
250
cpe:2.3:h:sharp:bp-b537wr:-:*:*:*:*:*:*:* |
|
| sharp | mx-b455w |
Affected:
404
cpe:2.3:h:sharp:mx-b455w:-:*:*:*:*:*:*:* |
|
| sharp | mx-b355w |
Affected:
404
cpe:2.3:h:sharp:mx-b355w:-:*:*:*:*:*:*:* |
|
| sharp | mx-b455wz |
Affected:
404
cpe:2.3:h:sharp:mx-b455wz:-:*:*:*:*:*:*:* |
|
| sharp | mx-b355wz |
Affected:
404
cpe:2.3:h:sharp:mx-b355wz:-:*:*:*:*:*:*:* |
|
| sharp | mx-b455wt |
Affected:
404
cpe:2.3:h:sharp:mx-b455wt:-:*:*:*:*:*:*:* |
|
| sharp | mx-b355wt |
Affected:
404
cpe:2.3:h:sharp:mx-b355wt:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:sharp:mx-m905:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m905",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "611"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m6070:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m6070",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m5070:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m5070",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m4070:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m4070",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m3570:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m3570",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m3070:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m3070",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m6050:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m6050",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m5050:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m5050",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m4050:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m4050",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m3550:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m3550",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m3050:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m3050",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m2630:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m2630",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m6070:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m6070",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-b550wd:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-b550wd",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "250"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-b540wr:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-b540wr",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "250"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-b547wd:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-b547wd",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "250"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-b537wr:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-b537wr",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "250"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-b455w:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-b455w",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "404"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-b355w:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-b355w",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "404"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-b455wz:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-b455wz",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "404"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-b355wz:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-b355wz",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "404"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-b455wt:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-b455wt",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "404"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-b355wt:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-b355wt",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "404"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-36251",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-26T16:19:13.648769Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T16:28:15.625Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T17:21:07.405Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Jul/0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Sharp Corporation listed under [References]"
}
]
},
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Toshiba Tec Corporation listed under [References]"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash. More precisely, a crafted parameter to billcodedef_sub_sel.html is not processed properly and device-crash happens. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds read",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T07:38:24.464Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"url": "https://www.toshibatec.com/information/20240531_02.html"
},
{
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU93051062/"
},
{
"url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-36251",
"datePublished": "2024-11-26T07:38:24.464Z",
"dateReserved": "2024-05-22T09:00:10.181Z",
"dateUpdated": "2025-11-04T17:21:07.405Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-36249 (GCVE-0-2024-36249)
Vulnerability from nvd – Published: 2024-11-26 07:38 – Updated: 2024-11-26 14:09
VLAI
Summary
Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers). If this vulnerability is exploited, an arbitrary script may be executed on the administrative page of the affected MFPs. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Cross-site scripting (XSS)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Sharp Corporation listed under [References]
|
|
| Toshiba Tec Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Toshiba Tec Corporation listed under [References]
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-36249",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-26T14:03:17.536595Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T14:09:24.516Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Sharp Corporation listed under [References]"
}
]
},
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Toshiba Tec Corporation listed under [References]"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers). If this vulnerability is exploited, an arbitrary script may be executed on the administrative page of the affected MFPs. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross-site scripting (XSS)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T07:38:18.359Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"url": "https://www.toshibatec.com/information/20240531_02.html"
},
{
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU93051062/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-36249",
"datePublished": "2024-11-26T07:38:18.359Z",
"dateReserved": "2024-05-22T09:00:09.251Z",
"dateUpdated": "2024-11-26T14:09:24.516Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-36248 (GCVE-0-2024-36248)
Vulnerability from nvd – Published: 2024-11-26 07:38 – Updated: 2025-11-04 17:21
VLAI
Summary
API keys for some cloud services are hardcoded in the "main" binary. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-798 - Use of hard-coded credentials
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Sharp Corporation listed under [References]
|
|
| Toshiba Tec Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Toshiba Tec Corporation listed under [References]
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-36248",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-27T16:20:15.617804Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-27T21:13:00.762Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T17:21:06.049Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Jul/0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Sharp Corporation listed under [References]"
}
]
},
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Toshiba Tec Corporation listed under [References]"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "API keys for some cloud services are hardcoded in the \"main\" binary. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "Use of hard-coded credentials",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T07:38:12.712Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"url": "https://www.toshibatec.com/information/20240531_02.html"
},
{
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU93051062/"
},
{
"url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-36248",
"datePublished": "2024-11-26T07:38:12.712Z",
"dateReserved": "2024-05-22T09:00:17.964Z",
"dateUpdated": "2025-11-04T17:21:06.049Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-35244 (GCVE-0-2024-35244)
Vulnerability from nvd – Published: 2024-11-26 07:38 – Updated: 2025-11-04 17:20
VLAI
Summary
There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by examining the coredump), these accounts can be used to re-configure the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-798 - Use of hard-coded credentials
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Sharp Corporation listed under [References]
|
|
| Toshiba Tec Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Toshiba Tec Corporation listed under [References]
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-35244",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-04T15:01:16.162778Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-27T21:13:00.628Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T17:20:50.877Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Jul/0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Sharp Corporation listed under [References]"
}
]
},
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Toshiba Tec Corporation listed under [References]"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by examining the coredump), these accounts can be used to re-configure the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "Use of hard-coded credentials",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T07:38:06.435Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"url": "https://www.toshibatec.com/information/20240531_02.html"
},
{
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU93051062/"
},
{
"url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-35244",
"datePublished": "2024-11-26T07:38:06.435Z",
"dateReserved": "2024-05-22T09:00:11.122Z",
"dateUpdated": "2025-11-04T17:20:50.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-34162 (GCVE-0-2024-34162)
Vulnerability from nvd – Published: 2024-11-26 07:37 – Updated: 2025-11-04 17:20
VLAI
Summary
The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authentication to "SIMPLE", the device communicates with the LDAP server in clear-text. The LDAP password can be retrieved from this clear-text communication. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-767 - Access to critical private variable via public method
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Sharp Corporation listed under [References]
|
|
| Toshiba Tec Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Toshiba Tec Corporation listed under [References]
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-34162",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-09T22:10:05.375457Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-10T15:43:40.628Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T17:20:30.355Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Jul/0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Sharp Corporation listed under [References]"
}
]
},
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Toshiba Tec Corporation listed under [References]"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authentication to \"SIMPLE\", the device communicates with the LDAP server in clear-text. The LDAP password can be retrieved from this clear-text communication. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-767",
"description": "Access to critical private variable via public method",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T07:37:57.671Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"url": "https://www.toshibatec.com/information/20240531_02.html"
},
{
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU93051062/"
},
{
"url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-34162",
"datePublished": "2024-11-26T07:37:57.671Z",
"dateReserved": "2024-05-22T09:00:13.769Z",
"dateUpdated": "2025-11-04T17:20:30.355Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-33616 (GCVE-0-2024-33616)
Vulnerability from nvd – Published: 2024-11-26 07:37 – Updated: 2025-11-04 17:20
VLAI
Summary
Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege. Sharp Corporation states the telnet feature is implemented on older models only, and is planning to provide the firmware update to remove the feature. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Authentication bypass
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Sharp Corporation listed under [References]
|
|
| Toshiba Tec Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Toshiba Tec Corporation listed under [References]
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-33616",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-09T22:10:06.870573Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-10T15:43:11.975Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T17:20:24.532Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Jul/0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Sharp Corporation listed under [References]"
}
]
},
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Toshiba Tec Corporation listed under [References]"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege. Sharp Corporation states the telnet feature is implemented on older models only, and is planning to provide the firmware update to remove the feature. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Authentication bypass",
"lang": "en-US",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T07:37:51.585Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"url": "https://www.toshibatec.com/information/20240531_02.html"
},
{
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU93051062/"
},
{
"url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-33616",
"datePublished": "2024-11-26T07:37:51.585Z",
"dateReserved": "2024-05-22T09:00:06.770Z",
"dateUpdated": "2025-11-04T17:20:24.532Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-33610 (GCVE-0-2024-33610)
Vulnerability from nvd – Published: 2024-11-26 07:37 – Updated: 2025-11-04 17:20
VLAI
Summary
"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides logged-in users' session information including session cookies, and "sys_trayentryreboot.html" allows to reboot the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Sharp Corporation listed under [References]
|
|
| Toshiba Tec Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Toshiba Tec Corporation listed under [References]
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-33610",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-09T22:10:22.048882Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-10T14:58:18.708Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T17:20:23.150Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Jul/0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Sharp Corporation listed under [References]"
}
]
},
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Toshiba Tec Corporation listed under [References]"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "\"sessionlist.html\" and \"sys_trayentryreboot.html\" are accessible with no authentication. \"sessionlist.html\" provides logged-in users\u0027 session information including session cookies, and \"sys_trayentryreboot.html\" allows to reboot the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "Authentication Bypass Using an Alternate Path or Channel",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T07:37:44.549Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"url": "https://www.toshibatec.com/information/20240531_02.html"
},
{
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU93051062/"
},
{
"url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-33610",
"datePublished": "2024-11-26T07:37:44.549Z",
"dateReserved": "2024-05-22T09:00:05.257Z",
"dateUpdated": "2025-11-04T17:20:23.150Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-33605 (GCVE-0-2024-33605)
Vulnerability from nvd – Published: 2024-11-26 07:37 – Updated: 2025-11-04 17:20
VLAI
Summary
Improper processing of some parameters of installed_emanual_list.html leads to a path traversal vulnerability. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper limitation of a pathname to a restricted directory ('Path Traversal')
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Sharp Corporation listed under [References]
|
|
| Toshiba Tec Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Toshiba Tec Corporation listed under [References]
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-33605",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-09T22:10:08.649799Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-10T15:43:57.213Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T17:20:21.774Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Jul/0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Sharp Corporation listed under [References]"
}
]
},
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Toshiba Tec Corporation listed under [References]"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper processing of some parameters of installed_emanual_list.html leads to a path traversal vulnerability. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper limitation of a pathname to a restricted directory (\u0027Path Traversal\u0027)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T10:58:21.785Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"url": "https://www.toshibatec.com/information/20240531_02.html"
},
{
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU93051062/"
},
{
"url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-33605",
"datePublished": "2024-11-26T07:37:38.329Z",
"dateReserved": "2024-05-22T09:00:15.651Z",
"dateUpdated": "2025-11-04T17:20:21.774Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-32151 (GCVE-0-2024-32151)
Vulnerability from nvd – Published: 2024-11-26 07:37 – Updated: 2025-11-04 17:20
VLAI
Summary
User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-257 - Storing passwords in a recoverable format
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Sharp Corporation listed under [References]
|
|
| Toshiba Tec Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Toshiba Tec Corporation listed under [References]
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-32151",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-26T14:03:23.265630Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T14:09:24.628Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T17:20:16.273Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Jul/0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Sharp Corporation listed under [References]"
}
]
},
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Toshiba Tec Corporation listed under [References]"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-257",
"description": "Storing passwords in a recoverable format",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T10:57:58.852Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"url": "https://www.toshibatec.com/information/20240531_02.html"
},
{
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU93051062/"
},
{
"url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-32151",
"datePublished": "2024-11-26T07:37:32.412Z",
"dateReserved": "2024-05-22T09:00:11.984Z",
"dateUpdated": "2025-11-04T17:20:16.273Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-29978 (GCVE-0-2024-29978)
Vulnerability from nvd – Published: 2024-11-26 07:37 – Updated: 2025-11-04 17:19
VLAI
Summary
User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-256 - Plaintext storage of a password
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Sharp Corporation listed under [References]
|
|
| Toshiba Tec Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Toshiba Tec Corporation listed under [References]
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-29978",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-04T17:36:38.117189Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-04T17:36:49.190Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T17:19:54.483Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Jul/0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Sharp Corporation listed under [References]"
}
]
},
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Toshiba Tec Corporation listed under [References]"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "Plaintext storage of a password",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T07:37:27.029Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"url": "https://www.toshibatec.com/information/20240531_02.html"
},
{
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU93051062/"
},
{
"url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-29978",
"datePublished": "2024-11-26T07:37:27.029Z",
"dateReserved": "2024-05-22T09:00:12.924Z",
"dateUpdated": "2025-11-04T17:19:54.483Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-29146 (GCVE-0-2024-29146)
Vulnerability from nvd – Published: 2024-11-26 07:37 – Updated: 2025-11-04 17:19
VLAI
Summary
User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-312 - Cleartext storage of sensitive information
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Sharp Corporation listed under [References]
|
|
| Toshiba Tec Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Toshiba Tec Corporation listed under [References]
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-29146",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-26T14:03:29.416641Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T14:09:24.767Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T17:19:53.061Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Jul/0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Sharp Corporation listed under [References]"
}
]
},
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Toshiba Tec Corporation listed under [References]"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-312",
"description": "Cleartext storage of sensitive information",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T07:37:20.253Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"url": "https://www.toshibatec.com/information/20240531_02.html"
},
{
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU93051062/"
},
{
"url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-29146",
"datePublished": "2024-11-26T07:37:20.253Z",
"dateReserved": "2024-05-22T09:00:07.612Z",
"dateUpdated": "2025-11-04T17:19:53.061Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-28955 (GCVE-0-2024-28955)
Vulnerability from nvd – Published: 2024-11-26 07:37 – Updated: 2025-11-04 17:19
VLAI
Summary
Affected devices create coredump files when crashed, storing them with world-readable permission. Any local user of the device can examine the coredump files, and research the memory contents. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-732 - Incorrect permission assignment for critical resource
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Sharp Corporation listed under [References]
|
|
| Toshiba Tec Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Toshiba Tec Corporation listed under [References]
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-28955",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-26T14:03:35.804923Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T14:09:24.903Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T17:19:40.571Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Jul/0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Sharp Corporation listed under [References]"
}
]
},
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Toshiba Tec Corporation listed under [References]"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Affected devices create coredump files when crashed, storing them with world-readable permission. Any local user of the device can examine the coredump files, and research the memory contents. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "Incorrect permission assignment for critical resource",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T07:37:14.737Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"url": "https://www.toshibatec.com/information/20240531_02.html"
},
{
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU93051062/"
},
{
"url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-28955",
"datePublished": "2024-11-26T07:37:14.737Z",
"dateReserved": "2024-05-22T09:00:18.956Z",
"dateUpdated": "2025-11-04T17:19:40.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-28038 (GCVE-0-2024-28038)
Vulnerability from nvd – Published: 2024-11-26 07:37 – Updated: 2025-11-04 17:19
VLAI
Summary
The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More precisely, giving too long character string to MFPSESSIONID parameter results in a stack buffer overflow. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
Severity
9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based buffer overflow
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Sharp Corporation listed under [References]
|
|
| Toshiba Tec Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Toshiba Tec Corporation listed under [References]
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-28038",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-09T22:09:23.255878Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-10T14:57:54.916Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T17:19:37.778Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Jul/0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Sharp Corporation listed under [References]"
}
]
},
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Toshiba Tec Corporation listed under [References]"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More precisely, giving too long character string to MFPSESSIONID parameter results in a stack buffer overflow. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based buffer overflow",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T07:37:06.324Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"url": "https://www.toshibatec.com/information/20240531_02.html"
},
{
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU93051062/"
},
{
"url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-28038",
"datePublished": "2024-11-26T07:37:06.324Z",
"dateReserved": "2024-05-22T09:00:14.691Z",
"dateUpdated": "2025-11-04T17:19:37.778Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-32326 (GCVE-0-2026-32326)
Vulnerability from cvelistv5 – Published: 2026-03-25 07:38 – Updated: 2026-03-25 13:26
VLAI
Summary
SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password of the device is left as the initial one, the device may be taken over.
Severity
5.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-306 - Missing authentication for critical function
Assigner
References
2 references
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | home 5G HR01 |
Affected:
38JP_0_490 and earlier
|
|
| Sharp Corporation | home 5G HR02 |
Affected:
S5.A1.00 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-52A |
Affected:
38JP_2_03J and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-52B |
Affected:
S3.87.15 and earlierr
|
|
| Sharp Corporation | Wi-Fi STATION SH-54C |
Affected:
S6.64.00 and earlier
|
|
| Sharp Corporation | 5G Mobile Router SH-U01 |
Affected:
S4.48.00 and earlier
|
|
| Sharp Corporation | Pocket WiFi 5G A503SH |
Affected:
S7.41.00 and earlier
|
|
| Sharp Corporation | Speed Wi-Fi 5G X01 |
Affected:
3RJP_2_03I and earlier
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-32326",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-25T13:26:41.257984Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T13:26:49.064Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "home 5G HR01",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "38JP_0_490 and earlier"
}
]
},
{
"product": "home 5G HR02",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S5.A1.00 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-52A",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "38JP_2_03J and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-52B",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S3.87.15 and earlierr"
}
]
},
{
"product": "Wi-Fi STATION SH-54C",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S6.64.00 and earlier"
}
]
},
{
"product": "5G Mobile Router SH-U01",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S4.48.00 and earlier"
}
]
},
{
"product": "Pocket WiFi 5G A503SH",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S7.41.00 and earlier"
}
]
},
{
"product": "Speed Wi-Fi 5G X01",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "3RJP_2_03I and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password of the device is left as the initial one, the device may be taken over."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing authentication for critical function",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T07:38:20.672Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://global.sharp/corporate/info/product-security/advisory-list/2026-002/"
},
{
"url": "https://jvn.jp/en/jp/JVN49524110/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-32326",
"datePublished": "2026-03-25T07:38:20.672Z",
"dateReserved": "2026-03-12T06:43:35.484Z",
"dateUpdated": "2026-03-25T13:26:49.064Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-54082 (GCVE-0-2024-54082)
Vulnerability from cvelistv5 – Published: 2024-12-23 00:18 – Updated: 2024-12-24 00:39
VLAI
Summary
home 5G HR02 and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the configuration restore function. An arbitrary OS command may be executed with the root privilege by an administrative user.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS Command Injection')
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | home 5G HR02 |
Affected:
S5.82.00 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-54C |
Affected:
S6.60.00 and earlier
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-54082",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-24T00:32:44.201878Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-24T00:39:24.102Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "home 5G HR02",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S5.82.00 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-54C",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S6.60.00 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "home 5G HR02 and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the configuration restore function. An arbitrary OS command may be executed with the root privilege by an administrative user."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper neutralization of special elements used in an OS command (\u0027OS Command Injection\u0027)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-23T00:18:12.865Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://k-tai.sharp.co.jp/support/info/info083.html"
},
{
"url": "https://jvn.jp/en/jp/JVN61635834/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-54082",
"datePublished": "2024-12-23T00:18:12.865Z",
"dateReserved": "2024-12-02T06:03:35.297Z",
"dateUpdated": "2024-12-24T00:39:24.102Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-52321 (GCVE-0-2024-52321)
Vulnerability from cvelistv5 – Published: 2024-12-23 00:18 – Updated: 2024-12-24 00:39
VLAI
Summary
Multiple SHARP routers contain an improper authentication vulnerability in the configuration backup function. The product's backup files containing sensitive information may be retrieved by a remote unauthenticated attacker.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-497 - Exposure of sensitive system information to an unauthorized control sphere
Assigner
References
2 references
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | home 5G HR02 |
Affected:
S5.82.00 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-52B |
Affected:
S3.87.11 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-54C |
Affected:
S6.60.00 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-05L |
Affected:
01.00.C0 and earlier
|
|
| Sharp Corporation | PocketWifi 809SH |
Affected:
01.00.B9 and earlier
|
|
| Sharp Corporation | Speed Wi-Fi NEXT W07 |
Affected:
02.00.48 and earlier
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-52321",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-24T00:31:17.038246Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-24T00:39:30.331Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "home 5G HR02",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S5.82.00 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-52B",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S3.87.11 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-54C",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S6.60.00 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-05L",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "01.00.C0 and earlier"
}
]
},
{
"product": "PocketWifi 809SH",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "01.00.B9 and earlier"
}
]
},
{
"product": "Speed Wi-Fi NEXT W07",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "02.00.48 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple SHARP routers contain an improper authentication vulnerability in the configuration backup function. The product\u0027s backup files containing sensitive information may be retrieved by a remote unauthenticated attacker."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-497",
"description": "Exposure of sensitive system information to an unauthorized control sphere",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-23T00:18:08.358Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://k-tai.sharp.co.jp/support/info/info083.html"
},
{
"url": "https://jvn.jp/en/jp/JVN61635834/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-52321",
"datePublished": "2024-12-23T00:18:08.358Z",
"dateReserved": "2024-12-02T06:03:32.297Z",
"dateUpdated": "2024-12-24T00:39:30.331Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-47864 (GCVE-0-2024-47864)
Vulnerability from cvelistv5 – Published: 2024-12-23 00:18 – Updated: 2024-12-24 00:39
VLAI
Summary
home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain a buffer overflow vulnerability in the hidden debug function. A remote unauthenticated attacker may get the web console of the product down.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-120 - Buffer overflow
Assigner
References
2 references
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | home 5G HR02 |
Affected:
S5.82.00 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-52B |
Affected:
S3.87.11 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-54C |
Affected:
S6.60.00 and earlier
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47864",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-24T00:35:27.338755Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-24T00:39:37.171Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "home 5G HR02",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S5.82.00 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-52B",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S3.87.11 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-54C",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S6.60.00 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain a buffer overflow vulnerability in the hidden debug function. A remote unauthenticated attacker may get the web console of the product down."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "Buffer overflow",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-23T00:18:03.318Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://k-tai.sharp.co.jp/support/info/info083.html"
},
{
"url": "https://jvn.jp/en/jp/JVN61635834/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-47864",
"datePublished": "2024-12-23T00:18:03.318Z",
"dateReserved": "2024-12-02T06:03:34.435Z",
"dateUpdated": "2024-12-24T00:39:37.171Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-46873 (GCVE-0-2024-46873)
Vulnerability from cvelistv5 – Published: 2024-12-23 00:17 – Updated: 2024-12-24 00:39
VLAI
Summary
Multiple SHARP routers leave the hidden debug function enabled. An arbitrary OS command may be executed with the root privilege by a remote unauthenticated attacker.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-489 - Active debug code
Assigner
References
2 references
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | home 5G HR02 |
Affected:
S5.82.00 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-52B |
Affected:
S3.87.11 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-54C |
Affected:
S6.60.00 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-05L |
Affected:
01.00.C0 and earlier
|
|
| Sharp Corporation | PocketWifi 809SH |
Affected:
01.00.B9 and earlier
|
|
| Sharp Corporation | Speed Wi-Fi NEXT W07 |
Affected:
02.00.48 and earlier
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46873",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-24T00:35:52.238750Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-24T00:39:44.951Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "home 5G HR02",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S5.82.00 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-52B",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S3.87.11 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-54C",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S6.60.00 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-05L",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "01.00.C0 and earlier"
}
]
},
{
"product": "PocketWifi 809SH",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "01.00.B9 and earlier"
}
]
},
{
"product": "Speed Wi-Fi NEXT W07",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "02.00.48 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple SHARP routers leave the hidden debug function enabled. An arbitrary OS command may be executed with the root privilege by a remote unauthenticated attacker."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-489",
"description": "Active debug code",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-23T00:17:59.216Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://k-tai.sharp.co.jp/support/info/info083.html"
},
{
"url": "https://jvn.jp/en/jp/JVN61635834/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-46873",
"datePublished": "2024-12-23T00:17:59.216Z",
"dateReserved": "2024-12-02T06:03:30.029Z",
"dateUpdated": "2024-12-24T00:39:44.951Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45721 (GCVE-0-2024-45721)
Vulnerability from cvelistv5 – Published: 2024-12-23 00:17 – Updated: 2024-12-24 00:39
VLAI
Summary
home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the HOST name configuration screen. An arbitrary OS command may be executed with the root privilege by an administrative user.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS Command Injection')
Assigner
References
2 references
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | home 5G HR02 |
Affected:
S5.82.00 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-52B |
Affected:
S3.87.11 and earlier
|
|
| Sharp Corporation | Wi-Fi STATION SH-54C |
Affected:
S6.60.00 and earlier
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-45721",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-24T00:32:46.849402Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-24T00:39:52.364Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "home 5G HR02",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S5.82.00 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-52B",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S3.87.11 and earlier"
}
]
},
{
"product": "Wi-Fi STATION SH-54C",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "S6.60.00 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the HOST name configuration screen. An arbitrary OS command may be executed with the root privilege by an administrative user."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper neutralization of special elements used in an OS command (\u0027OS Command Injection\u0027)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-23T00:17:55.581Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://k-tai.sharp.co.jp/support/info/info083.html"
},
{
"url": "https://jvn.jp/en/jp/JVN61635834/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-45721",
"datePublished": "2024-12-23T00:17:55.581Z",
"dateReserved": "2024-12-02T06:03:33.501Z",
"dateUpdated": "2024-12-24T00:39:52.364Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-36254 (GCVE-0-2024-36254)
Vulnerability from cvelistv5 – Published: 2024-11-26 07:38 – Updated: 2024-11-26 14:48
VLAI
Summary
Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lead to a denial-of-service (DoS) condition.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-bounds read
Assigner
References
Impacted products
51 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Sharp Corporation listed under [References]
|
|
| Toshiba Tec Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Toshiba Tec Corporation listed under [References]
|
|
| sharp | bp-90c70 |
Affected:
0 , ≤ 200
(custom)
cpe:2.3:h:sharp:bp-90c70:-:*:*:*:*:*:*:* |
|
| sharp | bp-90c80 |
Affected:
0 , ≤ 200
(custom)
cpe:2.3:h:sharp:bp-90c80:-:*:*:*:*:*:*:* |
|
| sharp | bp-70c65 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-70c65:-:*:*:*:*:*:*:* |
|
| sharp | bp-70c55 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-70c55:-:*:*:*:*:*:*:* |
|
| sharp | bp-70c45 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-70c45:-:*:*:*:*:*:*:* |
|
| sharp | bp-70c36 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-70c36:-:*:*:*:*:*:*:* |
|
| sharp | bp-70c31 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-70c31:-:*:*:*:*:*:*:* |
|
| sharp | bp-60c45 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-60c45:-:*:*:*:*:*:*:* |
|
| sharp | bp-60c36 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-60c36:-:*:*:*:*:*:*:* |
|
| sharp | bp-60c31 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-60c31:-:*:*:*:*:*:*:* |
|
| sharp | bp-50c65 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-50c65:-:*:*:*:*:*:*:* |
|
| sharp | bp-50c55 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-50c55:-:*:*:*:*:*:*:* |
|
| sharp | bp-50c45 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-50c45:-:*:*:*:*:*:*:* |
|
| sharp | bp-50c36 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-50c36:-:*:*:*:*:*:*:* |
|
| sharp | bp-50c31 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-50c31:-:*:*:*:*:*:*:* |
|
| sharp | bp-50c26 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-50c26:-:*:*:*:*:*:*:* |
|
| sharp | bp-55c26 |
Affected:
0 , ≤ 310
(custom)
cpe:2.3:h:sharp:bp-55c26:-:*:*:*:*:*:*:* |
|
| sharp | mx-8081 |
Affected:
0 , ≤ 150
(custom)
cpe:2.3:h:sharp:mx-8081:-:*:*:*:*:*:*:* |
|
| sharp | mx-7081 |
Affected:
0 , ≤ 150
(custom)
cpe:2.3:h:sharp:mx-7081:-:*:*:*:*:*:*:* |
|
| sharp | mx-6071 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-6071:-:*:*:*:*:*:*:* |
|
| sharp | mx-5071 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-5071:-:*:*:*:*:*:*:* |
|
| sharp | mx-4071 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-4071:-:*:*:*:*:*:*:* |
|
| sharp | mx-3571 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-3571:-:*:*:*:*:*:*:* |
|
| sharp | mx-3071 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-3071:-:*:*:*:*:*:*:* |
|
| sharp | mx-4061 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-4061:-:*:*:*:*:*:*:* |
|
| sharp | mx-3561 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-3561:-:*:*:*:*:*:*:* |
|
| sharp | mx-3061 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-3061:-:*:*:*:*:*:*:* |
|
| sharp | mx-6051 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-6051:-:*:*:*:*:*:*:* |
|
| sharp | mx-5051 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-5051:-:*:*:*:*:*:*:* |
|
| sharp | mx-4051 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-4051:-:*:*:*:*:*:*:* |
|
| sharp | mx-3551 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-3551:-:*:*:*:*:*:*:* |
|
| sharp | mx-3051 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-3051:-:*:*:*:*:*:*:* |
|
| sharp | mx-2651 |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-2651:-:*:*:*:*:*:*:* |
|
| sharp | mx-6071s |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-6071s:-:*:*:*:*:*:*:* |
|
| sharp | mx-5071s |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-5071s:-:*:*:*:*:*:*:* |
|
| sharp | mx-4071s |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-4071s:-:*:*:*:*:*:*:* |
|
| sharp | mx-3571s |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-3571s:-:*:*:*:*:*:*:* |
|
| sharp | mx-3071s |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-3071s:-:*:*:*:*:*:*:* |
|
| sharp | mx-4061s |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-4061s:-:*:*:*:*:*:*:* |
|
| sharp | mx-3561s |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-3561s:-:*:*:*:*:*:*:* |
|
| sharp | mx-3061s |
Affected:
0 , ≤ 612
(custom)
cpe:2.3:h:sharp:mx-3061s:-:*:*:*:*:*:*:* |
|
| sharp | bp-30c25 |
Affected:
0 , ≤ 123
(custom)
cpe:2.3:h:sharp:bp-30c25:-:*:*:*:*:*:*:* |
|
| sharp | bp-30c25y |
Affected:
0 , ≤ 123
(custom)
cpe:2.3:h:sharp:bp-30c25y:-:*:*:*:*:*:*:* |
|
| sharp | bp-30c25z |
Affected:
0 , ≤ 123
(custom)
cpe:2.3:h:sharp:bp-30c25z:-:*:*:*:*:*:*:* |
|
| sharp | bp-30c25t |
Affected:
0 , ≤ 123
(custom)
cpe:2.3:h:sharp:bp-30c25t:-:*:*:*:*:*:*:* |
|
| sharp | mx-7580n |
Affected:
0 , ≤ 502
(custom)
cpe:2.3:h:sharp:mx-7580n:-:*:*:*:*:*:*:* |
|
| sharp | mx-6580n |
Affected:
0 , ≤ 502
(custom)
cpe:2.3:h:sharp:mx-6580n:-:*:*:*:*:*:*:* |
|
| sharp | mx-8090n |
Affected:
0 , ≤ 404
(custom)
cpe:2.3:h:sharp:mx-8090n:-:*:*:*:*:*:*:* |
|
| sharp | mx-7090n |
Affected:
0 , ≤ 404
(custom)
cpe:2.3:h:sharp:mx-7090n:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:sharp:bp-90c70:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-90c70",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "200",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-90c80:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-90c80",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "200",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-70c65:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-70c65",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-70c55:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-70c55",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-70c45:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-70c45",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-70c36:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-70c36",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-70c31:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-70c31",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-60c45:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-60c45",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-60c36:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-60c36",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-60c31:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-60c31",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-50c65:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-50c65",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-50c55:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-50c55",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-50c45:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-50c45",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-50c36:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-50c36",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-50c31:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-50c31",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-50c26:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-50c26",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-55c26:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-55c26",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-8081:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-8081",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "150",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-7081:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-7081",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "150",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-6071:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-6071",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-5071:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-5071",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-4071:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-4071",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-3571:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-3571",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-3071:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-3071",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-4061:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-4061",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-3561:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-3561",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-3061:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-3061",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-6051:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-6051",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-5051:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-5051",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-4051:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-4051",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-3551:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-3551",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-3051:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-3051",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-2651:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-2651",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-6071s:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-6071s",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-5071s:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-5071s",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-4071s:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-4071s",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-3571s:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-3571s",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-3071s:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-3071s",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-4061s:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-4061s",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-3561s:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-3561s",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-3061s:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-3061s",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "612",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-30c25:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-30c25",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "123",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-30c25y:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-30c25y",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "123",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-30c25z:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-30c25z",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "123",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-30c25t:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-30c25t",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "123",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-7580n:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-7580n",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "502",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-6580n:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-6580n",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "502",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-8090n:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-8090n",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "404",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-7090n:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-7090n",
"vendor": "sharp",
"versions": [
{
"lessThanOrEqual": "404",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-36254",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-26T14:24:25.876189Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T14:48:35.480Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Sharp Corporation listed under [References]"
}
]
},
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Toshiba Tec Corporation listed under [References]"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lead to a denial-of-service (DoS) condition."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds read",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T07:38:30.408Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"url": "https://www.toshibatec.com/information/20240531_02.html"
},
{
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU93051062/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-36254",
"datePublished": "2024-11-26T07:38:30.408Z",
"dateReserved": "2024-05-22T09:00:17.089Z",
"dateUpdated": "2024-11-26T14:48:35.480Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-36251 (GCVE-0-2024-36251)
Vulnerability from cvelistv5 – Published: 2024-11-26 07:38 – Updated: 2025-11-04 17:21
VLAI
Summary
The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash. More precisely, a crafted parameter to billcodedef_sub_sel.html is not processed properly and device-crash happens. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-bounds read
Assigner
References
7 references
Impacted products
24 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Sharp Corporation listed under [References]
|
|
| Toshiba Tec Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Toshiba Tec Corporation listed under [References]
|
|
| sharp | mx-m905 |
Affected:
611
cpe:2.3:h:sharp:mx-m905:-:*:*:*:*:*:*:* |
|
| sharp | mx-m6070 |
Affected:
502
cpe:2.3:h:sharp:mx-m6070:-:*:*:*:*:*:*:* |
|
| sharp | mx-m5070 |
Affected:
502
cpe:2.3:h:sharp:mx-m5070:-:*:*:*:*:*:*:* |
|
| sharp | mx-m4070 |
Affected:
502
cpe:2.3:h:sharp:mx-m4070:-:*:*:*:*:*:*:* |
|
| sharp | mx-m3570 |
Affected:
502
cpe:2.3:h:sharp:mx-m3570:-:*:*:*:*:*:*:* |
|
| sharp | mx-m3070 |
Affected:
502
cpe:2.3:h:sharp:mx-m3070:-:*:*:*:*:*:*:* |
|
| sharp | mx-m6050 |
Affected:
502
cpe:2.3:h:sharp:mx-m6050:-:*:*:*:*:*:*:* |
|
| sharp | mx-m5050 |
Affected:
502
cpe:2.3:h:sharp:mx-m5050:-:*:*:*:*:*:*:* |
|
| sharp | mx-m4050 |
Affected:
502
cpe:2.3:h:sharp:mx-m4050:-:*:*:*:*:*:*:* |
|
| sharp | mx-m3550 |
Affected:
502
cpe:2.3:h:sharp:mx-m3550:-:*:*:*:*:*:*:* |
|
| sharp | mx-m3050 |
Affected:
502
cpe:2.3:h:sharp:mx-m3050:-:*:*:*:*:*:*:* |
|
| sharp | mx-m2630 |
Affected:
502
cpe:2.3:h:sharp:mx-m2630:-:*:*:*:*:*:*:* |
|
| sharp | bp-b550wd |
Affected:
250
cpe:2.3:h:sharp:bp-b550wd:-:*:*:*:*:*:*:* |
|
| sharp | bp-b540wr |
Affected:
250
cpe:2.3:h:sharp:bp-b540wr:-:*:*:*:*:*:*:* |
|
| sharp | bp-b547wd |
Affected:
250
cpe:2.3:h:sharp:bp-b547wd:-:*:*:*:*:*:*:* |
|
| sharp | bp-b537wr |
Affected:
250
cpe:2.3:h:sharp:bp-b537wr:-:*:*:*:*:*:*:* |
|
| sharp | mx-b455w |
Affected:
404
cpe:2.3:h:sharp:mx-b455w:-:*:*:*:*:*:*:* |
|
| sharp | mx-b355w |
Affected:
404
cpe:2.3:h:sharp:mx-b355w:-:*:*:*:*:*:*:* |
|
| sharp | mx-b455wz |
Affected:
404
cpe:2.3:h:sharp:mx-b455wz:-:*:*:*:*:*:*:* |
|
| sharp | mx-b355wz |
Affected:
404
cpe:2.3:h:sharp:mx-b355wz:-:*:*:*:*:*:*:* |
|
| sharp | mx-b455wt |
Affected:
404
cpe:2.3:h:sharp:mx-b455wt:-:*:*:*:*:*:*:* |
|
| sharp | mx-b355wt |
Affected:
404
cpe:2.3:h:sharp:mx-b355wt:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:sharp:mx-m905:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m905",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "611"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m6070:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m6070",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m5070:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m5070",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m4070:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m4070",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m3570:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m3570",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m3070:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m3070",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m6050:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m6050",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m5050:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m5050",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m4050:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m4050",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m3550:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m3550",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m3050:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m3050",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m2630:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m2630",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-m6070:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-m6070",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "502"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-b550wd:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-b550wd",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "250"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-b540wr:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-b540wr",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "250"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-b547wd:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-b547wd",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "250"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:bp-b537wr:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "bp-b537wr",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "250"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-b455w:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-b455w",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "404"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-b355w:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-b355w",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "404"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-b455wz:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-b455wz",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "404"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-b355wz:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-b355wz",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "404"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-b455wt:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-b455wt",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "404"
}
]
},
{
"cpes": [
"cpe:2.3:h:sharp:mx-b355wt:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mx-b355wt",
"vendor": "sharp",
"versions": [
{
"status": "affected",
"version": "404"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-36251",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-26T16:19:13.648769Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T16:28:15.625Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T17:21:07.405Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Jul/0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Sharp Corporation listed under [References]"
}
]
},
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Toshiba Tec Corporation listed under [References]"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash. More precisely, a crafted parameter to billcodedef_sub_sel.html is not processed properly and device-crash happens. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds read",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T07:38:24.464Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"url": "https://www.toshibatec.com/information/20240531_02.html"
},
{
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU93051062/"
},
{
"url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-36251",
"datePublished": "2024-11-26T07:38:24.464Z",
"dateReserved": "2024-05-22T09:00:10.181Z",
"dateUpdated": "2025-11-04T17:21:07.405Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-36249 (GCVE-0-2024-36249)
Vulnerability from cvelistv5 – Published: 2024-11-26 07:38 – Updated: 2024-11-26 14:09
VLAI
Summary
Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers). If this vulnerability is exploited, an arbitrary script may be executed on the administrative page of the affected MFPs. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Cross-site scripting (XSS)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Sharp Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Sharp Corporation listed under [References]
|
|
| Toshiba Tec Corporation | Multiple MFPs (multifunction printers) |
Affected:
See the information provided by Toshiba Tec Corporation listed under [References]
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-36249",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-26T14:03:17.536595Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T14:09:24.516Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Sharp Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Sharp Corporation listed under [References]"
}
]
},
{
"product": "Multiple MFPs (multifunction printers)",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "See the information provided by Toshiba Tec Corporation listed under [References]"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers). If this vulnerability is exploited, an arbitrary script may be executed on the administrative page of the affected MFPs. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross-site scripting (XSS)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T07:38:18.359Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"url": "https://www.toshibatec.com/information/20240531_02.html"
},
{
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU93051062/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-36249",
"datePublished": "2024-11-26T07:38:18.359Z",
"dateReserved": "2024-05-22T09:00:09.251Z",
"dateUpdated": "2024-11-26T14:09:24.516Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
JVNDB-2024-000128
Vulnerability from jvndb - Published: 2024-12-17 07:54 - Updated:2024-12-17 07:54
Severity
Summary
Multiple vulnerabilities in SHARP routers
Details
SHARP routers contain multiple vulnerabilities listed below.
- OS command injection vulnerability in the HOST name configuration screen (CWE-78) - CVE-2024-45721
- The hidden debug function is enabled (CWE-489) - CVE-2024-46873
- Buffer overflow vulnerability in the hidden debug function (CWE-120) - CVE-2024-47864
- Improper authentication vulnerability in the configuration backup function (CWE-497) - CVE-2024-52321
- OS command injection vulnerability in the configuration restore function (CWE-78) - CVE-2024-54082
References
Impacted products
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000128.html",
"dc:date": "2024-12-17T07:54+09:00",
"dcterms:issued": "2024-12-17T07:54+09:00",
"dcterms:modified": "2024-12-17T07:54+09:00",
"description": "SHARP routers contain multiple vulnerabilities listed below.\r\n\u003cul\u003e\u003cli\u003eOS command injection vulnerability in the HOST name configuration screen (CWE-78) - CVE-2024-45721\u003c/li\u003e\r\n\u003cli\u003eThe hidden debug function is enabled (CWE-489) - CVE-2024-46873\r\n\u003cli\u003eBuffer overflow vulnerability in the hidden debug function (CWE-120) - CVE-2024-47864\u003c/li\u003e\r\n\u003cli\u003eImproper authentication vulnerability in the configuration backup function (CWE-497) - CVE-2024-52321\u003c/li\u003e\r\n\u003cli\u003eOS command injection vulnerability in the configuration restore function (CWE-78) - CVE-2024-54082\u003c/li\u003e\u003c/ul\u003e\r\n\r\nShuto Imai of LAC Co., Ltd. reported these vulnerabilities to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000128.html",
"sec:cpe": [
{
"#text": "cpe:/o:sharp:809sh",
"@product": "PocketWifi 809SH",
"@vendor": "Sharp Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:sharp:hr02",
"@product": "home 5G HR02",
"@vendor": "Sharp Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:sharp:sh-05l",
"@product": "Wi-Fi STATION SH-05L",
"@vendor": "Sharp Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:sharp:sh-52b",
"@product": "Wi-Fi STATION SH-52B",
"@vendor": "Sharp Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:sharp:sh54c",
"@product": "Wi-Fi STATION SH-54C",
"@vendor": "Sharp Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:sharp:w07",
"@product": "Speed Wi-Fi NEXT W07",
"@vendor": "Sharp Corporation",
"@version": "2.2"
}
],
"sec:cvss": {
"@score": "9.8",
"@severity": "Critical",
"@type": "Base",
"@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"@version": "3.0"
},
"sec:identifier": "JVNDB-2024-000128",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN61635834/index.html",
"@id": "JVN#61635834",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2024-46873",
"@id": "CVE-2024-46873",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2024-45721",
"@id": "CVE-2024-45721",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2024-54082",
"@id": "CVE-2024-54082",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2024-52321",
"@id": "CVE-2024-52321",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2024-47864",
"@id": "CVE-2024-47864",
"@source": "CVE"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-78",
"@title": "OS Command Injection(CWE-78)"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-Other",
"@title": "No Mapping(CWE-Other)"
}
],
"title": "Multiple vulnerabilities in SHARP routers"
}