CVE-2024-35244

Published: Nov 26, 2024Modified: Jun 17, 2026Deferred

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: vultures@jpcert.or.jp (Secondary)

Description

There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by examining the coredump), these accounts can be used to re-configure the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

Related CWEs

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

References (7)

https://global.sharp/products/copier/info/info_security_2024-05.html

Source: vultures@jpcert.or.jp

https://jp.sharp/business/print/information/info_security_2024-05.html

Source: vultures@jpcert.or.jp

https://jvn.jp/en/vu/JVNVU93051062/

Source: vultures@jpcert.or.jp

https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html

Source: vultures@jpcert.or.jp

https://www.toshibatec.co.jp/information/20240531_02.html

Source: vultures@jpcert.or.jp

https://www.toshibatec.com/information/20240531_02.html

Source: vultures@jpcert.or.jp

http://seclists.org/fulldisclosure/2024/Jul/0

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.