Paper/Archive/CVE-2024-36248

CVE-2024-36248

Sharp Corporation Multiple MFPs (multifunction printers) — API keys for some cloud services are hardcoded in the "main" binary.

EPSS 1%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA, ADP agree)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 64.7.647 × 2012.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

API keys for some cloud services are hardcoded in the "main" binary. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

Affected

ProductAffectedFixed inSource

Multiple MFPs (multifunction printers)See the information provided by Sharp Corporation listed under [References]–CNA

Multiple MFPs (multifunction printers)See the information provided by Toshiba Tec Corporation listed under [References]–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

jpcert (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refglobal.sharp/products/copier/info/info_security_2024-05.html refjp.sharp/business/print/information/info_security_2024-05.html reftoshibatec.com/information/20240531_02.html reftoshibatec.co.jp/information/20240531_02.html refjvn.jp/en/vu/JVNVU93051062 refpierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html refseclists.org/fulldisclosure/2024/Jul/0