Critical severity · published Nov 26, 2024
CVE-2024-36248
API keys for some cloud services are hardcoded in the "main" binary
9.1
CVSS
1.1%
EPSS
No
On KEV
Description
API keys for some cloud services are hardcoded in the "main" binary. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MM
Multiple MFPs (multifunction printers) · Sharp Corporation
See the information provided by Sharp Corporation listed under [References] · source: vendor
Affected product
MM
Multiple MFPs (multifunction printers)
Sharp Corporation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-36248
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-36248
global.sharp
https://global.sharp/products/copier/info/info_security_2024-05.html
jp.sharp
https://jp.sharp/business/print/information/info_security_2024-05.html
jvn.jp
https://jvn.jp/en/vu/JVNVU93051062/
pierrekim.github.io
https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html
www.toshibatec.co.jp
https://www.toshibatec.co.jp/information/20240531_02.html
www.toshibatec.com
https://www.toshibatec.com/information/20240531_02.html
More from Multiple MFPs (multifunction printers)
9.1
CVE-2024-35244
There are several hidden accounts
9.1
CVE-2024-33610
"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication
9.0
CVE-2024-28038
The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow
7.5
CVE-2024-36254
Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lead to a denial-of-service (DoS)…
7.5
CVE-2024-36251
The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash