Fujifilm Apeos EUVD-2026-90549

Requires adjacent-network access to the target device plus HIGH privileges - an authenticated/administrative session on the web management interface of an affected Fujifilm/Sharp multifunction printer (e.g. Apeos C4571 or C3567 running firmware 1.1.3 or earlier, or other listed models). The attacker then submits a specially crafted malicious request whose externally supplied parameter contains path-traversal sequences. Limiting factors: no remote internet-wide exposure (AV:A, not AV:N), no exploitation without admin credentials (PR:H), and impact is confined to file/data disclosure (VC:H) with no integrity or availability effect. Devices whose management interfaces are segmented from untrusted networks and protected with strong admin credentials face substantially reduced real-world risk.

Signals are consistent but point to a moderate, access-gated issue rather than an urgent priority. The CVSS 4.0 vector (AV:A/AC:L/PR:H/UI:N, VC:H/VI:N/VA:N, base 6.8) describes an adjacent-network, low-complexity, HIGH-privilege attack yielding confidentiality-only impact (file read via CWE-22 path traversal) with no integrity or availability loss and no scope change. The PR:H requirement is the dominant limiting factor: an attacker must already hold administrative/authenticated access to the device web management interface, which sharply narrows the realistic threat population. AV:A (adjacent, not full network) further constrains reach to the local/management network segment rather than the open internet. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no public exploit identified at time of analysis. The description is deliberately vague ('may trigger unintended processing'), which is typical of coordinated MFP vendor advisories and limits precision on exact impact; this is noted rather than treated as confirmed severity. Net: a real but defense-in-depth-class issue - patch during normal maintenance, not an emergency, especially where device management interfaces are already segmented off untrusted networks.

An attacker with administrative credentials on the device's web management interface, positioned on the same adjacent/management network as an affected Apeos multifunction printer, sends a specially crafted request containing traversal sequences in an externally supplied parameter. The path traversal causes the device to read and return files outside the intended directory, disclosing sensitive device configuration or stored data. No public proof-of-concept exploit was identified for this CVE.