Status: UPDATED
| Advisory ID: CVE-2024-58388
Key Details
| CVE | CVE-2024-58388 |
| CVSS Score / Version | 7.5 (High) / CVSS v3.1 |
| Updated | 2026-10-02 |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVSS Prose | attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is none; availability impact is none. |
| Affected products | Sharp Corporation Multiple Multifunction Printers and Toshiba Tec Corporation Multiple Multifunction Printers |
| Classified as | CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) |
Affected Products, Subsystems & Sectors
| Subsystems | General OT |
| Sectors | Multiple |
What to Know
Sharp (and Toshiba Tec rebranded) multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbitrary files by manipulating the path parameter in the installed_emanual_down.html endpoint. Attackers can supply directory traversal sequences such as path=/manual/../../../<path> to access files outside the intended manual directory, including /etc/passwd, coredump files containing credentials, and system configuration files. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30. (NVD)
What to Do
Monitor Sharp Corporation's and Toshiba Tec Corporation's web pages for any future patch releases.
References