Sharp Mfps
Monthly
Unauthenticated network access to address book editing and Document Filing features is possible on Sharp and Toshiba Tec multifunction printers (MFPs) sold outside Japan, because these devices ship from the factory with user authentication disabled. The root cause is CWE-1188 (Insecure Default Initialization of Resource) - the authentication control exists but is not activated in the initial configuration, meaning any network-reachable attacker can access sensitive stored data and modify contact directories without credentials. No public exploit code and no CISA KEV listing exist at time of analysis, but the CVSS vector confirms network-level unauthenticated access with no interaction required.
Incomplete cleanup of cached print job data in Sharp and Toshiba Tec multifunction printers exposes previously printed documents to subsequent physical users of the same device. Affecting all versions per CPE data (cpe:2.3:a:sharp_corporation:sharp_mfps and cpe:2.3:a:toshiba_tec_corporation:toshiba_tec_mfps), the flaw (CWE-459) means internal caches are not wiped after a print job completes, allowing the next person who physically accesses the device to potentially retrieve another user's data. No public exploit code exists and the vulnerability has not been added to CISA KEV, consistent with the low CVSS score of 2.4 and a physical-access attack vector.
Unauthenticated network access to stored image data affects Sharp and Toshiba Tec multifunction printers via a forced browsing vulnerability (CWE-425). Remote attackers without any credentials can directly request URLs referencing scanned or copied image data held on the device, bypassing the authorization layer entirely. Reported by JPCERT, this is an information disclosure issue with no public exploit identified at time of analysis and no confirmed active exploitation.
Unauthenticated network access to address book editing and Document Filing features is possible on Sharp and Toshiba Tec multifunction printers (MFPs) sold outside Japan, because these devices ship from the factory with user authentication disabled. The root cause is CWE-1188 (Insecure Default Initialization of Resource) - the authentication control exists but is not activated in the initial configuration, meaning any network-reachable attacker can access sensitive stored data and modify contact directories without credentials. No public exploit code and no CISA KEV listing exist at time of analysis, but the CVSS vector confirms network-level unauthenticated access with no interaction required.
Incomplete cleanup of cached print job data in Sharp and Toshiba Tec multifunction printers exposes previously printed documents to subsequent physical users of the same device. Affecting all versions per CPE data (cpe:2.3:a:sharp_corporation:sharp_mfps and cpe:2.3:a:toshiba_tec_corporation:toshiba_tec_mfps), the flaw (CWE-459) means internal caches are not wiped after a print job completes, allowing the next person who physically accesses the device to potentially retrieve another user's data. No public exploit code exists and the vulnerability has not been added to CISA KEV, consistent with the low CVSS score of 2.4 and a physical-access attack vector.
Unauthenticated network access to stored image data affects Sharp and Toshiba Tec multifunction printers via a forced browsing vulnerability (CWE-425). Remote attackers without any credentials can directly request URLs referencing scanned or copied image data held on the device, bypassing the authorization layer entirely. Reported by JPCERT, this is an information disclosure issue with no public exploit identified at time of analysis and no confirmed active exploitation.