Vulnerability-Lookup

JVNDB-2024-003253

Vulnerability from jvndb - Published: 2024-06-03 05:36 - Updated:2024-06-03 05:36

Severity

9.1 (Critical) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

Multiple vulnerabilities in Sharp and Toshiba Tec MFPs

Details

Sharp and Toshiba Tec MFPs (multifunction printers) contain multiple vulnerabilities listed below. * Stack-based Buffer Overflow (CWE-121) - CVE-2024-28038 * Incorrect Permission Assignment for Critical Resource (CWE-732) - CVE-2024-28955 * Cleartext Storage of Sensitive Information (CWE-312) - CVE-2024-29146 * Plaintext Storage of a Password (CWE-256) - CVE-2024-29978 * Storing Passwords in a Recoverable Format (CWE-257) - CVE-2024-32151 * Path Traversal (CWE-22) - CVE-2024-33605 * Improper Access Control (CWE-284) - CVE-2024-33610, CVE-2024-33616 * Access to Critical Private Variable via Public Method (CWE-767) - CVE-2024-34162 * Use of Hard-coded Credentials (CWE-798) - CVE-2024-35244, CVE-2024-36248 * Cross-site Scripting (CWE-79) - CVE-2024-36249 * Out-of-bounds Read (CWE-125) - CVE-2024-36251, CVE-2024-36254 As for the vulnerabilities listed below, Pierre Barre reported them to JPCERT/CC, and JPCERT/CC coordinated with Sharp Corporation. CVE-2024-28038, CVE-2024-28955, CVE-2024-29146, CVE-2024-29978, CVE-2024-32151, CVE-2024-33605, CVE-2024-33610, CVE-2024-33616, CVE-2024-34162, CVE-2024-35244, CVE-2024-36248, CVE-2024-36251, CVE-2024-36254 As for the vulnerabilities listed below, Sharp Corporation received reports and coordinated with the reporters directly, and after the coordination was completed, Sharp reported them to JPCERT/CC to notify the users of the solutions through JVN. CVE-2024-33610, CVE-2024-36249, CVE-2024-36251, CVE-2024-36254

References

Type

URL

	JVN	https://jvn.jp/en/vu/JVNVU93051062/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-28038
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-28955
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-29146
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-29978
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-32151
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-33605
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-33610
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-33616
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-34162
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-35244
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-36248
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-36249
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-36251
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-36254
	Stack-based Buffer Overflow(CWE-121)	https://cwe.mitre.org/data/definitions/121.html
	Out-of-bounds Read(CWE-125)	https://cwe.mitre.org/data/definitions/125.html
	Path Traversal(CWE-22)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Unprotected Storage of Credentials(CWE-256)	https://cwe.mitre.org/data/definitions/256.html
	Storing Passwords in a Recoverable Format(CWE-257)	https://cwe.mitre.org/data/definitions/257.html
	Improper Access Control(CWE-284)	https://cwe.mitre.org/data/definitions/284.html
	Cleartext Storage of Sensitive Information(CWE-312)	https://cwe.mitre.org/data/definitions/312.html
	Incorrect Permission Assignment for Critical Resource(CWE-732)	https://cwe.mitre.org/data/definitions/732.html
	Access to Critical Private Variable via Public Method(CWE-767)	https://cwe.mitre.org/data/definitions/767.html
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Use of Hard-coded Credentials(CWE-798)	https://cwe.mitre.org/data/definitions/798.html

Impacted products

Vendor

Product

	Sharp Corporation	(Multiple Products)
	TOSHIBA TEC	(Multiple Products)

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-003253.html",
  "dc:date": "2024-06-03T14:36+09:00",
  "dcterms:issued": "2024-06-03T14:36+09:00",
  "dcterms:modified": "2024-06-03T14:36+09:00",
  "description": "Sharp and Toshiba Tec MFPs (multifunction printers) contain multiple vulnerabilities listed below.\r\n\r\n  * Stack-based Buffer Overflow (CWE-121) - CVE-2024-28038\r\n  * Incorrect Permission Assignment for Critical Resource (CWE-732) - CVE-2024-28955\r\n  * Cleartext Storage of Sensitive Information (CWE-312) - CVE-2024-29146\r\n  * Plaintext Storage of a Password (CWE-256) - CVE-2024-29978\r\n  * Storing Passwords in a Recoverable Format (CWE-257) - CVE-2024-32151\r\n  * Path Traversal (CWE-22) - CVE-2024-33605\r\n  * Improper Access Control (CWE-284) - CVE-2024-33610, CVE-2024-33616\r\n  * Access to Critical Private Variable via Public Method (CWE-767) - CVE-2024-34162\r\n  * Use of Hard-coded Credentials (CWE-798) - CVE-2024-35244, CVE-2024-36248\r\n  * Cross-site Scripting (CWE-79) - CVE-2024-36249\r\n  * Out-of-bounds Read (CWE-125) - CVE-2024-36251, CVE-2024-36254\r\n\r\nAs for the vulnerabilities listed below, Pierre Barre reported them to JPCERT/CC, and JPCERT/CC coordinated with Sharp Corporation.\r\nCVE-2024-28038, CVE-2024-28955, CVE-2024-29146, CVE-2024-29978, CVE-2024-32151, CVE-2024-33605, CVE-2024-33610, CVE-2024-33616, CVE-2024-34162, CVE-2024-35244, CVE-2024-36248, CVE-2024-36251, CVE-2024-36254\r\n\r\nAs for the vulnerabilities listed below, Sharp Corporation received reports and coordinated with the reporters directly, and after the coordination was completed, Sharp reported them to JPCERT/CC to notify the users of the solutions through JVN.\r\nCVE-2024-33610, CVE-2024-36249, CVE-2024-36251, CVE-2024-36254",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-003253.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:sharp:multiple_product",
      "@product": "(Multiple Products)",
      "@vendor": "Sharp Corporation",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:toshibatec:multiple_product",
      "@product": "(Multiple Products)",
      "@vendor": "TOSHIBA TEC",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "9.1",
    "@severity": "Critical",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2024-003253",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU93051062/index.html",
      "@id": "JVNVU#93051062",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-28038",
      "@id": "CVE-2024-28038",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-28955",
      "@id": "CVE-2024-28955",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-29146",
      "@id": "CVE-2024-29146",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-29978",
      "@id": "CVE-2024-29978",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-32151",
      "@id": "CVE-2024-32151",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-33605",
      "@id": "CVE-2024-33605",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-33610",
      "@id": "CVE-2024-33610",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-33616",
      "@id": "CVE-2024-33616",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-34162",
      "@id": "CVE-2024-34162",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-35244",
      "@id": "CVE-2024-35244",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-36248",
      "@id": "CVE-2024-36248",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-36249",
      "@id": "CVE-2024-36249",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-36251",
      "@id": "CVE-2024-36251",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-36254",
      "@id": "CVE-2024-36254",
      "@source": "CVE"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/121.html",
      "@id": "CWE-121",
      "@title": "Stack-based Buffer Overflow(CWE-121)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/125.html",
      "@id": "CWE-125",
      "@title": "Out-of-bounds Read(CWE-125)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/256.html",
      "@id": "CWE-256",
      "@title": "Unprotected Storage of Credentials(CWE-256)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/257.html",
      "@id": "CWE-257",
      "@title": "Storing Passwords in a Recoverable Format(CWE-257)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/284.html",
      "@id": "CWE-284",
      "@title": "Improper Access Control(CWE-284)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/312.html",
      "@id": "CWE-312",
      "@title": "Cleartext Storage of Sensitive Information(CWE-312)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/732.html",
      "@id": "CWE-732",
      "@title": "Incorrect Permission Assignment for Critical Resource(CWE-732)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/767.html",
      "@id": "CWE-767",
      "@title": "Access to Critical Private Variable via Public Method(CWE-767)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/798.html",
      "@id": "CWE-798",
      "@title": "Use of Hard-coded Credentials(CWE-798)"
    }
  ],
  "title": "Multiple vulnerabilities in Sharp and Toshiba Tec MFPs"
}

CVE-2024-28038 (GCVE-0-2024-28038)

Vulnerability from cvelistv5 – Published: 2024-11-26 07:37 – Updated: 2025-11-04 17:19

Summary

The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More precisely, giving too long character string to MFPSESSIONID parameter results in a stack buffer overflow. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

Severity

9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-09 22:09 UTC

CWE

CWE-121 - Stack-based buffer overflow

Assigner

jpcert CNA under the jpcert root

CNA scorecard C 64/100 over 191 records in the last 180 days details

References

7 references

URL	Tags
https://global.sharp/products/copier/info/info_se…
https://jp.sharp/business/print/information/info_…
https://www.toshibatec.com/information/20240531_02.html
https://www.toshibatec.co.jp/information/20240531…
https://jvn.jp/en/vu/JVNVU93051062/
https://pierrekim.github.io/blog/2024-06-27-sharp…
http://seclists.org/fulldisclosure/2024/Jul/0

Impacted products

2 products

Vendor	Product	Version
Sharp Corporation	Multiple MFPs (multifunction printers)	Affected: See the information provided by Sharp Corporation listed under [References]
Toshiba Tec Corporation	Multiple MFPs (multifunction printers)	Affected: See the information provided by Toshiba Tec Corporation listed under [References]

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-28038",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-09T22:09:23.255878Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-10T14:57:54.916Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:19:37.778Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2024/Jul/0"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Multiple MFPs (multifunction printers)",
          "vendor": "Sharp Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "See the information provided by Sharp Corporation listed under [References]"
            }
          ]
        },
        {
          "product": "Multiple MFPs (multifunction printers)",
          "vendor": "Toshiba Tec Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "See the information provided by Toshiba Tec Corporation listed under [References]"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More precisely, giving too long character string to MFPSESSIONID parameter results in a stack buffer overflow. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "Stack-based buffer overflow",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-26T07:37:06.324Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
        },
        {
          "url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
        },
        {
          "url": "https://www.toshibatec.com/information/20240531_02.html"
        },
        {
          "url": "https://www.toshibatec.co.jp/information/20240531_02.html"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU93051062/"
        },
        {
          "url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-28038",
    "datePublished": "2024-11-26T07:37:06.324Z",
    "dateReserved": "2024-05-22T09:00:14.691Z",
    "dateUpdated": "2025-11-04T17:19:37.778Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-28955 (GCVE-0-2024-28955)

Vulnerability from cvelistv5 – Published: 2024-11-26 07:37 – Updated: 2025-11-04 17:19

Summary

Affected devices create coredump files when crashed, storing them with world-readable permission. Any local user of the device can examine the coredump files, and research the memory contents. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-26 14:03 UTC

CWE

CWE-732 - Incorrect permission assignment for critical resource

Assigner

jpcert CNA under the jpcert root

CNA scorecard C 64/100 over 191 records in the last 180 days details

References

7 references

URL	Tags
https://global.sharp/products/copier/info/info_se…
https://jp.sharp/business/print/information/info_…
https://www.toshibatec.com/information/20240531_02.html
https://www.toshibatec.co.jp/information/20240531…
https://jvn.jp/en/vu/JVNVU93051062/
https://pierrekim.github.io/blog/2024-06-27-sharp…
http://seclists.org/fulldisclosure/2024/Jul/0

Impacted products

2 products

Vendor	Product	Version
Sharp Corporation	Multiple MFPs (multifunction printers)	Affected: See the information provided by Sharp Corporation listed under [References]
Toshiba Tec Corporation	Multiple MFPs (multifunction printers)	Affected: See the information provided by Toshiba Tec Corporation listed under [References]

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-28955",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-26T14:03:35.804923Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-26T14:09:24.903Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:19:40.571Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2024/Jul/0"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Multiple MFPs (multifunction printers)",
          "vendor": "Sharp Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "See the information provided by Sharp Corporation listed under [References]"
            }
          ]
        },
        {
          "product": "Multiple MFPs (multifunction printers)",
          "vendor": "Toshiba Tec Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "See the information provided by Toshiba Tec Corporation listed under [References]"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Affected devices create coredump files when crashed, storing them with world-readable permission. Any local user of the device can examine the coredump files, and research the memory contents. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "Incorrect permission assignment for critical resource",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-26T07:37:14.737Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
        },
        {
          "url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
        },
        {
          "url": "https://www.toshibatec.com/information/20240531_02.html"
        },
        {
          "url": "https://www.toshibatec.co.jp/information/20240531_02.html"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU93051062/"
        },
        {
          "url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-28955",
    "datePublished": "2024-11-26T07:37:14.737Z",
    "dateReserved": "2024-05-22T09:00:18.956Z",
    "dateUpdated": "2025-11-04T17:19:40.571Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-29146 (GCVE-0-2024-29146)

Vulnerability from cvelistv5 – Published: 2024-11-26 07:37 – Updated: 2025-11-04 17:19

Summary

User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-26 14:03 UTC

CWE

CWE-312 - Cleartext storage of sensitive information

Assigner

jpcert CNA under the jpcert root

CNA scorecard C 64/100 over 191 records in the last 180 days details

References

7 references

URL	Tags
https://global.sharp/products/copier/info/info_se…
https://jp.sharp/business/print/information/info_…
https://www.toshibatec.com/information/20240531_02.html
https://www.toshibatec.co.jp/information/20240531…
https://jvn.jp/en/vu/JVNVU93051062/
https://pierrekim.github.io/blog/2024-06-27-sharp…
http://seclists.org/fulldisclosure/2024/Jul/0

Impacted products

2 products

Vendor	Product	Version
Sharp Corporation	Multiple MFPs (multifunction printers)	Affected: See the information provided by Sharp Corporation listed under [References]
Toshiba Tec Corporation	Multiple MFPs (multifunction printers)	Affected: See the information provided by Toshiba Tec Corporation listed under [References]

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-29146",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-26T14:03:29.416641Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-26T14:09:24.767Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:19:53.061Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2024/Jul/0"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Multiple MFPs (multifunction printers)",
          "vendor": "Sharp Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "See the information provided by Sharp Corporation listed under [References]"
            }
          ]
        },
        {
          "product": "Multiple MFPs (multifunction printers)",
          "vendor": "Toshiba Tec Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "See the information provided by Toshiba Tec Corporation listed under [References]"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "Cleartext storage of sensitive information",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-26T07:37:20.253Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
        },
        {
          "url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
        },
        {
          "url": "https://www.toshibatec.com/information/20240531_02.html"
        },
        {
          "url": "https://www.toshibatec.co.jp/information/20240531_02.html"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU93051062/"
        },
        {
          "url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-29146",
    "datePublished": "2024-11-26T07:37:20.253Z",
    "dateReserved": "2024-05-22T09:00:07.612Z",
    "dateUpdated": "2025-11-04T17:19:53.061Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-29978 (GCVE-0-2024-29978)

Vulnerability from cvelistv5 – Published: 2024-11-26 07:37 – Updated: 2025-11-04 17:19

Summary

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-04 17:36 UTC

CWE

CWE-256 - Plaintext storage of a password

Assigner

jpcert CNA under the jpcert root

CNA scorecard C 64/100 over 191 records in the last 180 days details

References

7 references

URL	Tags
https://global.sharp/products/copier/info/info_se…
https://jp.sharp/business/print/information/info_…
https://www.toshibatec.com/information/20240531_02.html
https://www.toshibatec.co.jp/information/20240531…
https://jvn.jp/en/vu/JVNVU93051062/
https://pierrekim.github.io/blog/2024-06-27-sharp…
http://seclists.org/fulldisclosure/2024/Jul/0

Impacted products

2 products

Vendor	Product	Version
Sharp Corporation	Multiple MFPs (multifunction printers)	Affected: See the information provided by Sharp Corporation listed under [References]
Toshiba Tec Corporation	Multiple MFPs (multifunction printers)	Affected: See the information provided by Toshiba Tec Corporation listed under [References]

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-29978",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-04T17:36:38.117189Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-04T17:36:49.190Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:19:54.483Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2024/Jul/0"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Multiple MFPs (multifunction printers)",
          "vendor": "Sharp Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "See the information provided by Sharp Corporation listed under [References]"
            }
          ]
        },
        {
          "product": "Multiple MFPs (multifunction printers)",
          "vendor": "Toshiba Tec Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "See the information provided by Toshiba Tec Corporation listed under [References]"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-256",
              "description": "Plaintext storage of a password",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-26T07:37:27.029Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
        },
        {
          "url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
        },
        {
          "url": "https://www.toshibatec.com/information/20240531_02.html"
        },
        {
          "url": "https://www.toshibatec.co.jp/information/20240531_02.html"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU93051062/"
        },
        {
          "url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-29978",
    "datePublished": "2024-11-26T07:37:27.029Z",
    "dateReserved": "2024-05-22T09:00:12.924Z",
    "dateUpdated": "2025-11-04T17:19:54.483Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-32151 (GCVE-0-2024-32151)

Vulnerability from cvelistv5 – Published: 2024-11-26 07:37 – Updated: 2025-11-04 17:20

Summary

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-26 14:03 UTC

CWE

CWE-257 - Storing passwords in a recoverable format

Assigner

jpcert CNA under the jpcert root

CNA scorecard C 64/100 over 191 records in the last 180 days details

References

7 references

URL	Tags
https://global.sharp/products/copier/info/info_se…
https://jp.sharp/business/print/information/info_…
https://www.toshibatec.com/information/20240531_02.html
https://www.toshibatec.co.jp/information/20240531…
https://jvn.jp/en/vu/JVNVU93051062/
https://pierrekim.github.io/blog/2024-06-27-sharp…
http://seclists.org/fulldisclosure/2024/Jul/0

Impacted products

2 products

Vendor	Product	Version
Sharp Corporation	Multiple MFPs (multifunction printers)	Affected: See the information provided by Sharp Corporation listed under [References]
Toshiba Tec Corporation	Multiple MFPs (multifunction printers)	Affected: See the information provided by Toshiba Tec Corporation listed under [References]

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-32151",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-26T14:03:23.265630Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-26T14:09:24.628Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:20:16.273Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2024/Jul/0"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Multiple MFPs (multifunction printers)",
          "vendor": "Sharp Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "See the information provided by Sharp Corporation listed under [References]"
            }
          ]
        },
        {
          "product": "Multiple MFPs (multifunction printers)",
          "vendor": "Toshiba Tec Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "See the information provided by Toshiba Tec Corporation listed under [References]"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-257",
              "description": "Storing passwords in a recoverable format",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-26T10:57:58.852Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
        },
        {
          "url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
        },
        {
          "url": "https://www.toshibatec.com/information/20240531_02.html"
        },
        {
          "url": "https://www.toshibatec.co.jp/information/20240531_02.html"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU93051062/"
        },
        {
          "url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-32151",
    "datePublished": "2024-11-26T07:37:32.412Z",
    "dateReserved": "2024-05-22T09:00:11.984Z",
    "dateUpdated": "2025-11-04T17:20:16.273Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-33605 (GCVE-0-2024-33605)

Vulnerability from cvelistv5 – Published: 2024-11-26 07:37 – Updated: 2026-11-04 06:20

Summary

Improper processing of some parameters of installed_emanual_list.html and installed_emanual_down.html leads to a path traversal vulnerability. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-09 22:10 UTC

CWE

CWE-22 - Improper limitation of a pathname to a restricted directory ('Path Traversal')

Assigner

jpcert CNA under the jpcert root

CNA scorecard C 64/100 over 191 records in the last 180 days details

References

7 references

URL	Tags
https://global.sharp/products/copier/info/info_se…
https://jp.sharp/business/print/information/info_…
https://www.toshibatec.com/information/20240531_02.html
https://www.toshibatec.co.jp/information/20240531…
https://jvn.jp/en/vu/JVNVU93051062/
https://pierrekim.github.io/blog/2024-06-27-sharp…
http://seclists.org/fulldisclosure/2024/Jul/0

Impacted products

2 products

Vendor	Product	Version
Sharp Corporation	Multiple MFPs (multifunction printers)	Affected: See the information provided by Sharp Corporation listed under [References]
Toshiba Tec Corporation	Multiple MFPs (multifunction printers)	Affected: See the information provided by Toshiba Tec Corporation listed under [References]

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-33605",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-09T22:10:08.649799Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-10T15:43:57.213Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:20:21.774Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2024/Jul/0"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Multiple MFPs (multifunction printers)",
          "vendor": "Sharp Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "See the information provided by Sharp Corporation listed under [References]"
            }
          ]
        },
        {
          "product": "Multiple MFPs (multifunction printers)",
          "vendor": "Toshiba Tec Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "See the information provided by Toshiba Tec Corporation listed under [References]"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper processing of some parameters of installed_emanual_list.html and installed_emanual_down.html leads to a path traversal vulnerability. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper limitation of a pathname to a restricted directory (\u0027Path Traversal\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T06:20:17.557Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
        },
        {
          "url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
        },
        {
          "url": "https://www.toshibatec.com/information/20240531_02.html"
        },
        {
          "url": "https://www.toshibatec.co.jp/information/20240531_02.html"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU93051062/"
        },
        {
          "url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-33605",
    "datePublished": "2024-11-26T07:37:38.329Z",
    "dateReserved": "2024-05-22T09:00:15.651Z",
    "dateUpdated": "2026-11-04T06:20:17.557Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-33610 (GCVE-0-2024-33610)

Vulnerability from cvelistv5 – Published: 2024-11-26 07:37 – Updated: 2025-11-04 17:20

Summary

"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides logged-in users' session information including session cookies, and "sys_trayentryreboot.html" allows to reboot the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-09 22:10 UTC

CWE

CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Assigner

jpcert CNA under the jpcert root

CNA scorecard C 64/100 over 191 records in the last 180 days details

References

7 references

URL	Tags
https://global.sharp/products/copier/info/info_se…
https://jp.sharp/business/print/information/info_…
https://www.toshibatec.com/information/20240531_02.html
https://www.toshibatec.co.jp/information/20240531…
https://jvn.jp/en/vu/JVNVU93051062/
https://pierrekim.github.io/blog/2024-06-27-sharp…
http://seclists.org/fulldisclosure/2024/Jul/0

Impacted products

2 products

Vendor	Product	Version
Sharp Corporation	Multiple MFPs (multifunction printers)	Affected: See the information provided by Sharp Corporation listed under [References]
Toshiba Tec Corporation	Multiple MFPs (multifunction printers)	Affected: See the information provided by Toshiba Tec Corporation listed under [References]

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-33610",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-09T22:10:22.048882Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-10T14:58:18.708Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:20:23.150Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2024/Jul/0"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Multiple MFPs (multifunction printers)",
          "vendor": "Sharp Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "See the information provided by Sharp Corporation listed under [References]"
            }
          ]
        },
        {
          "product": "Multiple MFPs (multifunction printers)",
          "vendor": "Toshiba Tec Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "See the information provided by Toshiba Tec Corporation listed under [References]"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "\"sessionlist.html\" and \"sys_trayentryreboot.html\" are accessible with no authentication. \"sessionlist.html\" provides logged-in users\u0027 session information including session cookies, and \"sys_trayentryreboot.html\" allows to reboot the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-26T07:37:44.549Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
        },
        {
          "url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
        },
        {
          "url": "https://www.toshibatec.com/information/20240531_02.html"
        },
        {
          "url": "https://www.toshibatec.co.jp/information/20240531_02.html"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU93051062/"
        },
        {
          "url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-33610",
    "datePublished": "2024-11-26T07:37:44.549Z",
    "dateReserved": "2024-05-22T09:00:05.257Z",
    "dateUpdated": "2025-11-04T17:20:23.150Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-33616 (GCVE-0-2024-33616)

Vulnerability from cvelistv5 – Published: 2024-11-26 07:37 – Updated: 2025-11-04 17:20

Summary

Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege. Sharp Corporation states the telnet feature is implemented on older models only, and is planning to provide the firmware update to remove the feature. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-09 22:10 UTC

CWE

Authentication bypass
CWE-306 - Missing Authentication for Critical Function

Assigner

jpcert CNA under the jpcert root

CNA scorecard C 64/100 over 191 records in the last 180 days details

References

7 references

URL	Tags
https://global.sharp/products/copier/info/info_se…
https://jp.sharp/business/print/information/info_…
https://www.toshibatec.com/information/20240531_02.html
https://www.toshibatec.co.jp/information/20240531…
https://jvn.jp/en/vu/JVNVU93051062/
https://pierrekim.github.io/blog/2024-06-27-sharp…
http://seclists.org/fulldisclosure/2024/Jul/0

Impacted products

2 products

Vendor	Product	Version
Sharp Corporation	Multiple MFPs (multifunction printers)	Affected: See the information provided by Sharp Corporation listed under [References]
Toshiba Tec Corporation	Multiple MFPs (multifunction printers)	Affected: See the information provided by Toshiba Tec Corporation listed under [References]

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-33616",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-09T22:10:06.870573Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-306",
                "description": "CWE-306 Missing Authentication for Critical Function",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-10T15:43:11.975Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:20:24.532Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2024/Jul/0"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Multiple MFPs (multifunction printers)",
          "vendor": "Sharp Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "See the information provided by Sharp Corporation listed under [References]"
            }
          ]
        },
        {
          "product": "Multiple MFPs (multifunction printers)",
          "vendor": "Toshiba Tec Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "See the information provided by Toshiba Tec Corporation listed under [References]"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege. Sharp Corporation states the telnet feature is implemented on older models only, and is planning to provide the firmware update to remove the feature. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Authentication bypass",
              "lang": "en-US",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-26T07:37:51.585Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
        },
        {
          "url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
        },
        {
          "url": "https://www.toshibatec.com/information/20240531_02.html"
        },
        {
          "url": "https://www.toshibatec.co.jp/information/20240531_02.html"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU93051062/"
        },
        {
          "url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-33616",
    "datePublished": "2024-11-26T07:37:51.585Z",
    "dateReserved": "2024-05-22T09:00:06.770Z",
    "dateUpdated": "2025-11-04T17:20:24.532Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-34162 (GCVE-0-2024-34162)

Vulnerability from cvelistv5 – Published: 2024-11-26 07:37 – Updated: 2025-11-04 17:20

Summary

The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authentication to "SIMPLE", the device communicates with the LDAP server in clear-text. The LDAP password can be retrieved from this clear-text communication. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-09 22:10 UTC

CWE

CWE-767 - Access to critical private variable via public method

Assigner

jpcert CNA under the jpcert root

CNA scorecard C 64/100 over 191 records in the last 180 days details

References

7 references

URL	Tags
https://global.sharp/products/copier/info/info_se…
https://jp.sharp/business/print/information/info_…
https://www.toshibatec.com/information/20240531_02.html
https://www.toshibatec.co.jp/information/20240531…
https://jvn.jp/en/vu/JVNVU93051062/
https://pierrekim.github.io/blog/2024-06-27-sharp…
http://seclists.org/fulldisclosure/2024/Jul/0

Impacted products

2 products

Vendor	Product	Version
Sharp Corporation	Multiple MFPs (multifunction printers)	Affected: See the information provided by Sharp Corporation listed under [References]
Toshiba Tec Corporation	Multiple MFPs (multifunction printers)	Affected: See the information provided by Toshiba Tec Corporation listed under [References]

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-34162",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-09T22:10:05.375457Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-10T15:43:40.628Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:20:30.355Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2024/Jul/0"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Multiple MFPs (multifunction printers)",
          "vendor": "Sharp Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "See the information provided by Sharp Corporation listed under [References]"
            }
          ]
        },
        {
          "product": "Multiple MFPs (multifunction printers)",
          "vendor": "Toshiba Tec Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "See the information provided by Toshiba Tec Corporation listed under [References]"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authentication to \"SIMPLE\", the device communicates with the LDAP server in clear-text. The LDAP password can be retrieved from this clear-text communication. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-767",
              "description": "Access to critical private variable via public method",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-26T07:37:57.671Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
        },
        {
          "url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
        },
        {
          "url": "https://www.toshibatec.com/information/20240531_02.html"
        },
        {
          "url": "https://www.toshibatec.co.jp/information/20240531_02.html"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU93051062/"
        },
        {
          "url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-34162",
    "datePublished": "2024-11-26T07:37:57.671Z",
    "dateReserved": "2024-05-22T09:00:13.769Z",
    "dateUpdated": "2025-11-04T17:20:30.355Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-35244 (GCVE-0-2024-35244)

Vulnerability from cvelistv5 – Published: 2024-11-26 07:38 – Updated: 2025-11-04 17:20

Summary

There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by examining the coredump), these accounts can be used to re-configure the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-04 15:01 UTC

CWE

CWE-798 - Use of hard-coded credentials

Assigner

jpcert CNA under the jpcert root

CNA scorecard C 64/100 over 191 records in the last 180 days details

References

7 references

URL	Tags
https://global.sharp/products/copier/info/info_se…
https://jp.sharp/business/print/information/info_…
https://www.toshibatec.com/information/20240531_02.html
https://www.toshibatec.co.jp/information/20240531…
https://jvn.jp/en/vu/JVNVU93051062/
https://pierrekim.github.io/blog/2024-06-27-sharp…
http://seclists.org/fulldisclosure/2024/Jul/0

Impacted products

2 products

Vendor	Product	Version
Sharp Corporation	Multiple MFPs (multifunction printers)	Affected: See the information provided by Sharp Corporation listed under [References]
Toshiba Tec Corporation	Multiple MFPs (multifunction printers)	Affected: See the information provided by Toshiba Tec Corporation listed under [References]

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-35244",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-04T15:01:16.162778Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-27T21:13:00.628Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:20:50.877Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2024/Jul/0"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Multiple MFPs (multifunction printers)",
          "vendor": "Sharp Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "See the information provided by Sharp Corporation listed under [References]"
            }
          ]
        },
        {
          "product": "Multiple MFPs (multifunction printers)",
          "vendor": "Toshiba Tec Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "See the information provided by Toshiba Tec Corporation listed under [References]"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by examining the coredump), these accounts can be used to re-configure the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "Use of hard-coded credentials",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-26T07:38:06.435Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
        },
        {
          "url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
        },
        {
          "url": "https://www.toshibatec.com/information/20240531_02.html"
        },
        {
          "url": "https://www.toshibatec.co.jp/information/20240531_02.html"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU93051062/"
        },
        {
          "url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-35244",
    "datePublished": "2024-11-26T07:38:06.435Z",
    "dateReserved": "2024-05-22T09:00:11.122Z",
    "dateUpdated": "2025-11-04T17:20:50.877Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

JVNDB-2024-003253

CVE-2024-28038 (GCVE-0-2024-28038)

CVE-2024-28955 (GCVE-0-2024-28955)

CVE-2024-29146 (GCVE-0-2024-29146)

CVE-2024-29978 (GCVE-0-2024-29978)

CVE-2024-32151 (GCVE-0-2024-32151)

CVE-2024-33605 (GCVE-0-2024-33605)

CVE-2024-33610 (GCVE-0-2024-33610)

CVE-2024-33616 (GCVE-0-2024-33616)

CVE-2024-34162 (GCVE-0-2024-34162)

CVE-2024-35244 (GCVE-0-2024-35244)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour