Skip to main content

Sharp Toshiba MFPs EUVDEUVD-2026-52249

| CVE-2026-60011 MEDIUM
Direct Request ('Forced Browsing') (CWE-425)
2026-08-03 jpcert GHSA-wrg8-43fx-27hh
Information Disclosure Sharp Mfps Toshiba Tec Mfps
6.9
CVSS 4.0 · Vendor: jpcert
Share

Severity by source

Vendor (jpcert) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Network-reachable MFP web interface, no credentials required, read-only access to stored image data with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 03, 2026 - 09:22 vuln.today
CVSS changed
Aug 03, 2026 - 09:22 NVD
5.3 (MEDIUM) 6.9 (MEDIUM)

DescriptionCVE.org

Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image data stored to the affected product.

AnalysisAI

Unauthenticated network access to stored image data affects Sharp and Toshiba Tec multifunction printers via a forced browsing vulnerability (CWE-425). Remote attackers without any credentials can directly request URLs referencing scanned or copied image data held on the device, bypassing the authorization layer entirely. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Locate MFP web interface on network
Delivery
Enumerate predictable image resource URL patterns
Exploit
Send unauthenticated HTTP GET request
Execution
Bypass absent authorization check
Impact
Retrieve stored scanned document image data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The MFP must be reachable over the network by the attacker - the CVSS vector AV:N confirms network reachability is the primary access requirement. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a network-reachable, low-complexity, unauthenticated information disclosure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker on the same network segment as a Sharp or Toshiba Tec MFP - or with access through a misconfigured firewall - enumerates the device's web interface and discovers predictable URL patterns for stored scan or copy jobs. By issuing direct unauthenticated HTTP GET requests to those URLs, the attacker retrieves image files of documents previously scanned or copied on the device, with no credentials required. …
Remediation Apply firmware updates as released by Sharp and Toshiba Tec per their respective advisories: Sharp at https://global.sharp/corporate/info/product-security/advisory-list/2026-004/ and Toshiba Tec at https://www.toshibatec.com/information/20260731_01.html. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Sharp Mfps

View all
CVE-2026-63563 MEDIUM
6.9 Aug 03

Unauthenticated network access to address book editing and Document Filing features is possible on Sharp and Toshiba Tec
CVE-2026-63545 LOW
2.4 Aug 03

Incomplete cleanup of cached print job data in Sharp and Toshiba Tec multifunction printers exposes previously printed d

Same weakness CWE-425 – Direct Request ('Forced Browsing')

View all
CVE-2017-14244 CRITICAL POC
9.8
CVE-2024-0204 CRITICAL POC
9.8
CVE-2017-15235 HIGH POC
7.5
CVE-2024-24592 CRITICAL POC
9.8
CVE-2022-45276 CRITICAL POC
9.8
CVE-2022-26279 CRITICAL POC
9.8
CVE-2021-36560 CRITICAL POC
9.8
CVE-2020-24660 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-52249 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy