CVE-2024-45829 Information disclosure in Sharp Digital Full-color MFPs and Monochrome MFPs
Crafted HTTP requests to Sharp and Toshiba MFP web interfaces cause out-of-bounds reads, leading to data disclosure or device crashes.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-45829?
CVE-2024-45829 is a medium-severity vulnerability in Sharp Digital Full-color MFPs and Monochrome MFPs, published on 25 Oct 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Sharp and Toshiba Tec MFPs provide the web page to download data, where query parameters in HTTP requests are improperly processed and resulting in an Out-of-bounds Read vulnerability. Crafted HTTP requests may cause affected products crashed.
Weakness: CWE-125
Which versions are affected by CVE-2024-45829?
It affects 320 products.
Products include Sharp Bp-30c25 Firmware, Sharp Bp-30c25t Firmware, Sharp Bp-30c25y Firmware, Sharp Bp-30c25z Firmware, Sharp Bp-30m28 Firmware, Sharp Bp-30m28t Firmware and 314 more.
How do I fix CVE-2024-45829?
No fix has been published for CVE-2024-45829 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-45829 being exploited?
There is no known exploitation of CVE-2024-45829 in the wild and no public exploit code.
Other vulnerabilities in Sharp Digital Full-color MFPs and Monochrome MFPs
- CVE-2024-47406 Auth bypass in Sharp Digital Full-color MFPs and Monochrome MFPs
- CVE-2022-45796 SHARP Multifunction Printer - Command Injection
- CVE-2024-47005 Missing authorization in Sharp Digital Full-color MFPs and Monochrome MFPs
- CVE-2024-42420 Denial of service in Sharp Digital Full-color MFPs and Monochrome MFPs
- CVE-2024-43424 Memory corruption in Sharp Digital Full-color MFPs and Monochrome MFPs
Sources
Also known as GHSA-r83w-v683-gmv6.