Paper/Archive/CVE-2024-33610

CVE-2024-33610

Sharp Corporation Multiple MFPs (multifunction printers) — "sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication.

EPSS 50%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 98.9.989 × 2019.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides logged-in users' session information including session cookies, and "sys_trayentryreboot.html" allows to reboot the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

Affected

ProductAffectedFixed inSource

Multiple MFPs (multifunction printers)See the information provided by Sharp Corporation listed under [References]–CNA

Multiple MFPs (multifunction printers)See the information provided by Toshiba Tec Corporation listed under [References]–CNA

Scores by source

jpcert (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refglobal.sharp/products/copier/info/info_security_2024-05.html refjp.sharp/business/print/information/info_security_2024-05.html reftoshibatec.com/information/20240531_02.html reftoshibatec.co.jp/information/20240531_02.html refjvn.jp/en/vu/JVNVU93051062 refpierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html refseclists.org/fulldisclosure/2024/Jul/0