Sharp Multifunction Printers Local File Inclusion via installed_emanual_down.html
Sharp (and Toshiba Tec rebranded) multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbitrary files by manipulating the path parameter in the installed_emanual_down.html endpoint. Attackers can supply directory traversal sequences such as path=/manual/../../../ to access files outside the intended manual directory, including /etc/passwd, coredump files containing credentials, and system configuration files. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30.
CVE-2024-58388
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2024-58388
Multiple Multifunction Printers
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Multiple Multifunction Printers
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Sharp Corporation",
"product": "Multiple Multifunction Printers",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Toshiba Tec Corporation",
"product": "Multiple Multifunction Printers",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
]- Related CVEs
- CVE-2024-58388
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #8978 · Revision 1
- Added to Heist Feed
- Publisher date