High severity · published Nov 26, 2024
CVE-2024-36249
Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers)
7.4
CVSS
0.5%
EPSS
No
On KEV
Description
Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers). If this vulnerability is exploited, an arbitrary script may be executed on the administrative page of the affected MFPs. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MM
Multiple MFPs (multifunction printers) · Sharp Corporation
See the information provided by Sharp Corporation listed under [References] · source: vendor
Affected product
MM
Multiple MFPs (multifunction printers)
Sharp Corporation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-36249
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-36249
global.sharp
https://global.sharp/products/copier/info/info_security_2024-05.html
jp.sharp
https://jp.sharp/business/print/information/info_security_2024-05.html
jvn.jp
https://jvn.jp/en/vu/JVNVU93051062/
www.toshibatec.co.jp
https://www.toshibatec.co.jp/information/20240531_02.html
www.toshibatec.com
https://www.toshibatec.com/information/20240531_02.html
More from Multiple MFPs (multifunction printers)
9.1
CVE-2024-36248
API keys for some cloud services are hardcoded in the "main" binary
9.1
CVE-2024-35244
There are several hidden accounts
9.1
CVE-2024-33610
"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication
9.0
CVE-2024-28038
The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow
7.5
CVE-2024-36254
Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lead to a denial-of-service (DoS)…
