Sharp/Toshiba Multifunction Printer Vulnerabilities Analysis (CVE/Firmware)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Affected Products: - Sharp Corporation - Toshiba Tec Corporation 2. Vulnerability Description: - Multiple vulnerabilities, including: - Stack-based Buffer Overflow (CWE-121) - Incorrect Permission Assignment for Critical Resource (CWE-732) - Cleartext Storage of Sensitive Information (CWE-312) - Plaintext Storage of a Password (CWE-256) - Storing Passwords in a Recoverable Format (CWE-257) - Path Traversal (CWE-22) - Improper Access Control (Cwu-284) - Access to Critical Private Variable via Public Method (CWE-767) - Use of Hard-coded Credentials (CWE-798) - Cross-site Scripting (CWE-79) - Out-of-bounds Read (CWE-125) 3. Vulnerability Impact: - Sending specially crafted requests to the management page of affected multifunction printers may cause service disruption (DoS). - Arbitrary files within the affected multifunction printer can be viewed, potentially exposing information stored in the device. - Certain information within the affected multifunction printer can be accessed without proper authorization. - Arbitrary scripts can be executed on the management page of the affected multifunction printer. - Arbitrary code can be executed on the firmware of the affected multifunction printer. 4. Mitigation/Solution: - Update firmware: Apply appropriate firmware updates as provided by the vendors. - Apply workarounds: The following measures can help mitigate the impact of these vulnerabilities: - Use multifunction printers within protected networks, such as behind firewalls and routers. - Restrict access to the multifunction printer’s web interface by setting appropriate password policies. - Change default factory-set passwords and manage them securely. 5. Vendor Status: - Sharp Corporation: Vulnerable - Toshiba Tec Corporation: Vulnerable 6. Reference Links: - JPCERT/CC Addendum - Vulnerability Analysis by JPCERT/CC - Credit 7. Additional Information: - JPCERT Alert - JPCERT Reports - CERT Advisory - CPNI Advisory - TRnotes - CVE Links This information provides a comprehensive overview of the vulnerability, including its description, impact, mitigation steps, and vendor status.

Goal Reached Thanks to every supporter — we hit 100%!

Sharp/Toshiba Multifunction Printer Vulnerabilities Analysis (CVE/Firmware)