Sharp vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2024-58388 Sharp (and Toshiba Tec rebranded) multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbiHigh 8.7 · Oct 1, 2026
• CVE-2024-54082 home 5G HR02 and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the configuration restore function.High 7.2 · Dec 22, 2024
• CVE-2024-46873 Multiple SHARP routers leave the hidden debug function enabled.Critical 9.8 · Dec 22, 2024
• CVE-2024-45721 home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the HOST name configuration screen.High 7.2 · Dec 22, 2024
• CVE-2024-36254 Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lead to a denial-of-sHigh 7.5 · Nov 26, 2024
• CVE-2024-36251 The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash.High 7.5 · Nov 26, 2024
• CVE-2024-36249 Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers).High 7.4 · Nov 26, 2024
• CVE-2024-36248 API keys for some cloud services are hardcoded in the "main" binary.Critical 9.1 · Nov 26, 2024
• CVE-2024-35244 There are several hidden accounts.Critical 9.1 · Nov 26, 2024
• CVE-2024-33610 "sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication.Critical 9.1 · Nov 26, 2024
• CVE-2024-33605 Improper processing of some parameters of installed_emanual_list.html leads to a path traversal vulnerability.High 7.5 · Nov 26, 2024
• CVE-2024-28038 The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow.Critical 9 · Nov 26, 2024
• CVE-2024-47801 Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, resulting in a reflected cross-site scripting vulnerability.High 7.4 · Oct 25, 2024
• CVE-2024-47549 Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers.High 7.4 · Oct 25, 2024
• CVE-2024-47406 Sharp and Toshiba Tec MFPs improperly process HTTP authentication requests, resulting in an authentication bypass vulnerability.Critical 9.1 · Oct 25, 2024
• CVE-2024-47005 Sharp and Toshiba Tec MFPs provide configuration related APIs.High 8.1 · Oct 25, 2024
• CVE-2024-43424 Sharp and Toshiba Tec MFPs improperly process HTTP request headers, resulting in an Out-of-bounds Read vulnerability.High 7.5 · Oct 25, 2024
• CVE-2024-42420 Sharp and Toshiba Tec MFPs contain multiple Out-of-bounds Read vulnerabilities, due to improper processing of keyword search input and improper processing of SOHigh 7.5 · Oct 25, 2024
• CVE-2024-23789 Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arbiHigh 8.8 · Feb 14, 2024
• CVE-2024-23788 Server-side request forgery vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacenHigh 8.1 · Feb 14, 2024
• CVE-2024-23786 Cross-site scripting vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unautCritical 9.3 · Feb 14, 2024
• CVE-2024-23783 Improper authentication vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unHigh 8.8 · Feb 14, 2024
• CVE-2022-45796 Command injection vulnerability in nw_interface.html in SHARP multifunction printers (MFPs)'s Digital Full-color Multifunctional System 202 or earlier, 120 or eCritical 9.1 · Dec 16, 2022
• CVE-2020-5571 SHARP AQUOS series (AQUOS SH-M02 build number 01.00.05 and earlier, AQUOS SH-RM02 build number 01.00.04 and earlier, AQUOS mini SH-M03 build number 01.00.04 andHigh 7.5 · Apr 23, 2020
• CVE-2017-2192 Untrusted search path vulnerability in RW-5100 tool to verify execution environment for Windows 7 version 1.1.0.0 and RW-5100 tool to verify execution environmeHigh 7.8 · Jun 9, 2017