CVE-2024-47406 Auth bypass in Sharp Digital Full-color MFPs and Monochrome MFPs
Attackers can bypass authentication on Sharp and Toshiba multifunction printers by sending improperly processed HTTP requests, gaining unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-47406?
CVE-2024-47406 is a critical authentication bypass vulnerability in Sharp Digital Full-color MFPs and Monochrome MFPs, published on 25 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sharp and Toshiba Tec MFPs improperly process HTTP authentication requests, resulting in an authentication bypass vulnerability.
Which versions are affected by CVE-2024-47406?
It affects 320 products.
Products include Sharp Bp-30c25 Firmware, Sharp Bp-30c25t Firmware, Sharp Bp-30c25y Firmware, Sharp Bp-30c25z Firmware, Sharp Bp-30m28 Firmware, Sharp Bp-30m28t Firmware and 314 more.
How do I fix CVE-2024-47406?
No fix has been published for CVE-2024-47406 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-47406 being exploited?
There is no known exploitation of CVE-2024-47406 in the wild and no public exploit code.
Other vulnerabilities in Sharp Digital Full-color MFPs and Monochrome MFPs
- CVE-2022-45796 SHARP Multifunction Printer - Command Injection
- CVE-2024-47005 Missing authorization in Sharp Digital Full-color MFPs and Monochrome MFPs
- CVE-2024-42420 Denial of service in Sharp Digital Full-color MFPs and Monochrome MFPs
- CVE-2024-43424 Memory corruption in Sharp Digital Full-color MFPs and Monochrome MFPs
- CVE-2024-47549 Cross-site scripting in Sharp Digital Full-color MFPs and Monochrome MFPs
Sources
Also known as GHSA-vwp4-85g8-fgjg.