Sharp/Toshiba MFP Vulnerability Advisory: Auth Bypass, OOB Read, SSRF

Key Information 1. Affected Products: - Multifunction Printers (MFPs) provided by Sharp and Toshiba Tec Corporation, containing multiple vulnerabilities. 2. Vulnerability Descriptions: - Out-of-bounds Read (CWE-125): - CVSS Score: 7.5 - Description: Out-of-bounds read vulnerability due to improper handling of keyword search input and SOAP messages. - Out-of-bounds Read (CWE-125): - CVSS Score: 7.5 - Description: Out-of-bounds read vulnerability due to improper handling of HTTP request headers. - Out-of-bounds Read (CWE-125): - CVSS Score: 4.9 - Description: Out-of-bounds read vulnerability due to improper handling of data download in HTTP requests. - Path traversal (CWE-22): - CVSS Score: 5.3 - Description: Path traversal vulnerability due to improper handling of URI data in HTTP PUT requests. - Improper access restriction on some configuration-related APIs (CWE-749): - CVSS Score: 8.1 - Description: Some configuration-related APIs lack proper access restrictions. - Authentication Bypass Using an Alternate Path (CWE-288): - CVSS Score: 9.1 - Description: Authentication bypass vulnerability due to improper handling of HTTP authentication requests. - Improper processing of query parameters in HTTP requests (CWE-644): - CVSS Score: 7.4 - Description: Vulnerability due to improper processing of query parameters in HTTP requests. - Reflected Cross-site Scripting (CWE-79): - CVSS Score: 7.4 - Description: Reflected cross-site scripting vulnerability due to improper handling of query parameters in HTTP requests. - Stored Cross-site Scripting (CWE-79): - CVSS Score: 6.2 - Description: Stored cross-site scripting vulnerability due to improper input validation in URI data registration. 3. Impact: - Crafted HTTP requests may cause affected products to crash. - Internal files may be retrieved during processing of crafted HTTP requests. - Non-administrator users may execute certain configuration APIs. - Authentication may be bypassed. - Accessing crafted URLs pointing to affected products may lead to malicious scripts being executed in web browsers. - If crafted input is stored by an administrator user, malicious scripts may be executed in other victims’ web browsers. 4. Solutions: - Update firmware: Apply appropriate firmware updates as provided by the vendor. - Apply workarounds: - Place affected MFPs within a network protected by a firewall. - Set administrator password (initial password is set in default factory configuration; refer to product manual). - Change the default administrator password and manage it securely. 5. Vendor Status: - Sharp Corporation: Vulnerability status: Vulnerable - Toshiba Tec Corporation: Vulnerability status: Vulnerable 6. References: - JPCERT/CC Addendum - Vulnerability analysis conducted by JPCERT/CC - Credit: Sharp Corporation reported these vulnerabilities to JPCERT/CC and notified users of the solutions via JVN. 7. Additional Information: - JPCERT Alert - JPCERT Reports - CERT Advisory - CPNI Advisory - TRnotes - CVE - JVN iPedia 8. Update History: - 2024/10/25: Sharp Corporation updated status Summary This page provides detailed information on multiple vulnerabilities affecting Sharp and Toshiba Tec MFPs, including vulnerability types, impacts, solutions, and vendor status. This information is critical for identifying and remediating affected devices.

Goal Reached Thanks to every supporter — we hit 100%!

Sharp/Toshiba MFP Vulnerability Advisory: Auth Bypass, OOB Read, SSRF