CVE-2024-36248

Published: Nov 26, 2024Modified: Jun 17, 2026Deferred

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: vultures@jpcert.or.jp (Secondary)

Description

API keys for some cloud services are hardcoded in the "main" binary. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

Related CWEs

CWE-798

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

References (7)

https://global.sharp/products/copier/info/info_security_2024-05.html

Source: vultures@jpcert.or.jp

https://jp.sharp/business/print/information/info_security_2024-05.html

Source: vultures@jpcert.or.jp

https://jvn.jp/en/vu/JVNVU93051062/

Source: vultures@jpcert.or.jp

https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html

Source: vultures@jpcert.or.jp

https://www.toshibatec.co.jp/information/20240531_02.html

Source: vultures@jpcert.or.jp

https://www.toshibatec.com/information/20240531_02.html

Source: vultures@jpcert.or.jp

http://seclists.org/fulldisclosure/2024/Jul/0

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.