TToshiba Tec Corporation

Products

Exploited and recent CVEs

• CVE-2024-58388 High 7.5 Sharp Multifunction Printers Local File Inclusion via installed_emanual_down.html 0.8%
• CVE-2026-63563 Medium 6.5 Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication feature disabled in the initial configuration. When used with the initial config 0.4%
• CVE-2026-63545 Low 2.4 Sharp and Toshiba Tec MFPs (multifunction printers) caches data internally when printing, and leave them uncleared. They may be accessed later by other users. 0.2%
• CVE-2026-60011 Medium 5.3 Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image data stored to the affected product. 0.4%
• CVE-2025-49797 High 7.8 Multiple Brother driver installers for Windows contain a privilege escalation vulnerability. If exploited, an arbitrary program may be executed with the administrative privilege. As for the details of 0.2%
• CVE-2024-36254 High 7.5 Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lead to a denial-of-service (DoS) condition. 0.7%
• CVE-2024-36251 High 7.5 The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash. More precisely, a crafted parameter to billcodedef_sub_sel.html is not processed pro 3.5%
• CVE-2024-36249 High 7.4 Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers). If this vulnerability is exploited, an arbitrary script may be execu 0.6%
• CVE-2024-36248 Critical 9.1 API keys for some cloud services are hardcoded in the "main" binary. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vend 1.1%
• CVE-2024-35244 Critical 9.1 There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by examining the coredump), these accounts can be used to re-co 1.1%
• CVE-2024-34162 Medium 5.3 The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authentication to "SIMPLE", the device communicates with the LDAP 0.8%
• CVE-2024-33616 Medium 5.3 Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege. Sharp Corporation states the telnet feature is implemented on old 0.9%
• CVE-2024-33610 Critical 9.1 "sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides logged-in users' session information including session cookies, and "sys_trayentryr 50.5%
• CVE-2024-33605 High 7.5 Improper processing of some parameters of installed_emanual_list.html and installed_emanual_down.html leads to a path traversal vulnerability. As for the details of affected product names, model numbe 6.0%
• CVE-2024-32151 Medium 5.9 User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numb 1.3%
• CVE-2024-29978 Medium 5.9 User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numb 1.3%
• CVE-2024-29146 Medium 5.9 User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numb 0.8%
• CVE-2024-28955 Medium 5.9 Affected devices create coredump files when crashed, storing them with world-readable permission. Any local user of the device can examine the coredump files, and research the memory contents. As for 1.3%
• CVE-2024-28038 Critical 9.0 The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More precisely, giving too long character string to MFPSESSIONID parameter results in 2.6%
• CVE-2024-48870 Medium 6.2 Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability. If crafted input is stored by an administrative user, mal 0.3%
• CVE-2024-48870 Medium 6.2 Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability. If crafted input is stored by an administrative user, mal 0.3%
• CVE-2024-48870 Medium 6.2 Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability. If crafted input is stored by an administrative user, mal 0.3%
• CVE-2024-47801 High 7.4 Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, resulting in a reflected cross-site scripting vulnerability. Accessing a crafted URL which points to an affected produ 0.4%
• CVE-2024-47801 High 7.4 Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, resulting in a reflected cross-site scripting vulnerability. Accessing a crafted URL which points to an affected produ 0.4%
• CVE-2024-47801 High 7.4 Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, resulting in a reflected cross-site scripting vulnerability. Accessing a crafted URL which points to an affected produ 0.4%
• CVE-2024-47549 High 7.4 Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers. Accessing a crafted URL which points to an 0.4%
• CVE-2024-47549 High 7.4 Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers. Accessing a crafted URL which points to an 0.4%
• CVE-2024-47549 High 7.4 Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers. Accessing a crafted URL which points to an 0.4%
• CVE-2024-47406 Critical 9.1 Sharp and Toshiba Tec MFPs improperly process HTTP authentication requests, resulting in an authentication bypass vulnerability. 0.6%
• CVE-2024-47406 Critical 9.1 Sharp and Toshiba Tec MFPs improperly process HTTP authentication requests, resulting in an authentication bypass vulnerability. 0.6%