by Kastro
Paper/Archive/CVE-2024-35244

CVE-2024-35244

Sharp Corporation Multiple MFPs (multifunction printers) — There are several hidden accounts.

EPSS 1%CVSS 9.1
critical.is priorityof 100
40
CVSS 9.1 (CNA, ADP agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 64.7.647 × 2012.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by examining the coredump), these accounts can be used to re-configure the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

Affected

ProductAffectedFixed inSource
Multiple MFPs (multifunction printers)See the information provided by Sharp Corporation listed under [References]–CNA
Multiple MFPs (multifunction printers)See the information provided by Toshiba Tec Corporation listed under [References]–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
jpcert (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refglobal.sharp/products/copier/info/info_security_2024-05.htmlrefjp.sharp/business/print/information/info_security_2024-05.htmlreftoshibatec.com/information/20240531_02.htmlreftoshibatec.co.jp/information/20240531_02.htmlrefjvn.jp/en/vu/JVNVU93051062refpierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.htmlrefseclists.org/fulldisclosure/2024/Jul/0