CVSS 4.0
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.
- Експлоатация: има публичен пример за експлоатация
- Атаката може да се автоматизира
Описание
Оригинално описание
Sharp (and Toshiba Tec rebranded) multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbitrary files by manipulating the path parameter in the installed_emanual_down.html endpoint. Attackers can supply directory traversal sequences such as path=/manual/../../../<path> to access files outside the intended manual directory, including /etc/passwd, coredump files containing credentials, and system configuration files. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30.
Засегнати продукти
- Sharp Corporation Multiple Multifunction Printers: *
- Toshiba Tec Corporation Multiple Multifunction Printers: *
Вид слабост
История
- 1 октомври 2026 Публикувано
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2024-58388
- https://nvd.nist.gov/vuln/detail/CVE-2024-58388
- https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html#pre-auth-lfi
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/crocus-lfi.yaml
- https://www.vulncheck.com/advisories/sharp-multifunction-printers-local-file-inclusion-via-installed-emanual-down-html