Sharp Corporation
46 CVEs across 29 Sharp Corporation products. Browse Sharp Corporation vulnerabilities, severities, and proof-of-concept exploits.
Sharp Corporation products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-63563 | Medium | 6.5 | 2026-08-03 | Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication feature disabled in the initial configu… |
CVE-2026-63545 | Low | 2.4 | 2026-08-03 | Sharp and Toshiba Tec MFPs (multifunction printers) caches data internally when printing, and leave them uncleared. They may be accessed later by other users. |
CVE-2026-62416 | Medium | 5.3 | 2026-08-03 | Network Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation, with the initial configuration, require no authentication and accept files un… |
CVE-2026-60011 | Medium | 5.3 | 2026-08-03 | Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image data stored to the affected product. |
CVE-2026-32326 | Medium | 5.7 | 2026-03-25 | SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password o… |
CVE-2024-54082 | High | 7.2 | 2024-12-23 | home 5G HR02 and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the configuration restore function. An arbitrary OS command may be execu… |
CVE-2024-52321 | Medium | 5.9 | 2024-12-23 | Multiple SHARP routers contain an improper authentication vulnerability in the configuration backup function. The product's backup files containing sensitive i… |
CVE-2024-47864 | Medium | 5.3 | 2024-12-23 | home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain a buffer overflow vulnerability in the hidden debug function. A remote unauthenticated att… |
CVE-2024-46873 | Critical | 9.8 | 2024-12-23 | Multiple SHARP routers leave the hidden debug function enabled. An arbitrary OS command may be executed with the root privilege by a remote unauthenticated att… |
CVE-2024-45721 | High | 7.2 | 2024-12-23 | home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the HOST name configuration screen. An arbitrary… |
CVE-2024-36254 | High | 7.5 | 2024-11-26 | Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lead to a denial-of-… |
CVE-2024-36251 | High | 7.5 | 2024-11-26 | The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash. More precisely, a crafted parameter to bill… |
CVE-2024-36249 | High | 7.4 | 2024-11-26 | Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers). If this vulnerability is ex… |
CVE-2024-36248 | Critical | 9.1 | 2024-11-26 | API keys for some cloud services are hardcoded in the "main" binary. As for the details of affected product names, model numbers, and versions, refer to the in… |
CVE-2024-35244 | Critical | 9.1 | 2024-11-26 | There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by examining the cored… |
CVE-2024-34162 | Medium | 5.3 | 2024-11-26 | The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authentication to "SIMPL… |
CVE-2024-33616 | Medium | 5.3 | 2024-11-26 | Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege. Sharp Corporation states… |
CVE-2024-33610 | Critical | 9.1 | 2024-11-26 | "sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides logged-in users' session information inclu… |
CVE-2024-33605 | High | 7.5 | 2024-11-26 | Improper processing of some parameters of installed_emanual_list.html leads to a path traversal vulnerability. As for the details of affected product names, mo… |
CVE-2024-32151 | Medium | 5.9 | 2024-11-26 | User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the deta… |
CVE-2024-29978 | Medium | 5.9 | 2024-11-26 | User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the deta… |
CVE-2024-29146 | Medium | 5.9 | 2024-11-26 | User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the deta… |
CVE-2024-28955 | Medium | 5.9 | 2024-11-26 | Affected devices create coredump files when crashed, storing them with world-readable permission. Any local user of the device can examine the coredump files… |
CVE-2024-28038 | Critical | 9.0 | 2024-11-26 | The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More precisely, giving too long character st… |
CVE-2024-48870 | Medium | 6.2 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability. If crafted input… |
CVE-2024-47801 | High | 7.4 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, resulting in a reflected cross-site scripting vulnerability. Accessing a craf… |
CVE-2024-47549 | High | 7.4 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers. Ac… |
CVE-2024-47406 | Critical | 9.1 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process HTTP authentication requests, resulting in an authentication bypass vulnerability. |
CVE-2024-47005 | High | 8.1 | 2024-10-25 | Sharp and Toshiba Tec MFPs provide configuration related APIs. They are expected to be called by administrative users only, but insufficiently restricted. A n… |
CVE-2024-45842 | Medium | 5.3 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process URI data in HTTP PUT requests resulting in a path Traversal vulnerability. Unintended internal files may be retr… |
CVE-2024-45829 | Medium | 4.9 | 2024-10-25 | Sharp and Toshiba Tec MFPs provide the web page to download data, where query parameters in HTTP requests are improperly processed and resulting in an Out-of-b… |
CVE-2024-43424 | High | 7.5 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process HTTP request headers, resulting in an Out-of-bounds Read vulnerability. Crafted HTTP requests may cause affected… |
CVE-2024-42420 | High | 7.5 | 2024-10-25 | Sharp and Toshiba Tec MFPs contain multiple Out-of-bounds Read vulnerabilities, due to improper processing of keyword search input and improper processing of S… |
CVE-2024-23789 | High | 8.8 | 2024-02-14 | Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arb… |
CVE-2024-23788 | High | 8.1 | 2024-02-14 | Server-side request forgery vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjace… |
CVE-2024-23787 | Medium | 6.5 | 2024-02-14 | Path traversal vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenti… |
CVE-2024-23786 | Critical | 9.3 | 2024-02-14 | Cross-site scripting vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unau… |
CVE-2024-23785 | Medium | 6.5 | 2024-02-14 | Cross-site request forgery vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a remote unauthen… |
CVE-2024-23784 | Medium | 6.5 | 2024-02-14 | Improper access control vulnerability exists in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier, which may allow a n… |
CVE-2024-23783 | High | 8.8 | 2024-02-14 | Improper authentication vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent u… |
CVE-2020-5571 | High | 7.5 | 2020-04-23 | SHARP AQUOS series (AQUOS SH-M02 build number 01.00.05 and earlier, AQUOS SH-RM02 build number 01.00.04 and earlier, AQUOS mini SH-M03 build number 01.00.04 an… |
CVE-2017-10890 | Medium | 4.6 | 2017-11-17 | Session management issue in RX-V200 firmware versions prior to 09.87.17.09, RX-V100 firmware versions prior to 03.29.17.09, RX-CLV1-P firmware versions prior t… |
CVE-2017-2192 | High | 7.8 | 2017-06-09 | Untrusted search path vulnerability in RW-5100 tool to verify execution environment for Windows 7 version 1.1.0.0 and RW-5100 tool to verify execution environm… |
CVE-2017-2191 | High | 7.8 | 2017-06-09 | Untrusted search path vulnerability in RW-5100 driver installer for Windows 7 version 1.0.0.9 and RW-5100 driver installer for Windows 8.1 version 1.0.1.0 allo… |
CVE-2017-2190 | High | 7.8 | 2017-06-09 | Untrusted search path vulnerability in RW-4040 tool to verify execution environment for Windows 7 version 1.2.0.0 allows an attacker to gain privileges via a T… |
CVE-2017-2189 | High | 7.8 | 2017-06-09 | Untrusted search path vulnerability in RW-4040 driver installer for Windows 7 version 2.27 allows an attacker to gain privileges via a Trojan horse DLL in an u… |