CVE-2024-47005 Missing authorization in Sharp Digital Full-color MFPs and Monochrome MFPs

High 8.1 Published 25 Oct 2024 Updated 25 Oct 2024

Non-administrative users can execute restricted configuration APIs on Sharp and Toshiba MFPs, allowing unauthorized device configuration changes.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-47005?

CVE-2024-47005 is a high-severity missing authorization vulnerability in Sharp Digital Full-color MFPs and Monochrome MFPs, published on 25 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Sharp and Toshiba Tec MFPs provide configuration related APIs. They are expected to be called by administrative users only, but insufficiently restricted. A non-administrative user may execute some configuration APIs.

Weakness: CWE-749

Which versions are affected by CVE-2024-47005?

It affects 320 products.

Products include Sharp Bp-30c25 Firmware, Sharp Bp-30c25t Firmware, Sharp Bp-30c25y Firmware, Sharp Bp-30c25z Firmware, Sharp Bp-30m28 Firmware, Sharp Bp-30m28t Firmware and 314 more.

How do I fix CVE-2024-47005?

No fix has been published for CVE-2024-47005 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-47005 being exploited?

There is no known exploitation of CVE-2024-47005 in the wild and no public exploit code.

Sources

Also known as GHSA-29pv-3whx-cqwv.