CVE-2024-58388
Sharp Multifunction Printers Local File Inclusion via installed_emanual_down.html
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Sharp (and Toshiba Tec rebranded) multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbitrary files by manipulating the path parameter in the installed_emanual_down.html endpoint. Attackers can supply directory traversal sequences such as path=/manual/../../../<path> to access files outside the intended manual directory, including /etc/passwd, coredump files containing credentials, and system configuration files. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30.
| CWE | CWE-22 |
| Vendor | sharp corporation |
| Product | multiple multifunction printers |
| Published | Oct 1, 2026 |
Stay Ahead of the Next One
Get instant alerts for sharp corporation multiple multifunction printers
Be the first to know when new high vulnerabilities affecting sharp corporation multiple multifunction printers are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
Sharp Corporation / Multiple Multifunction Printers
*
Toshiba Tec Corporation / Multiple Multifunction Printers
*
References
pierrekim.github.io: https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html#pre-auth-lfi github.com: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/crocus-lfi.yaml vulncheck.com: https://www.vulncheck.com/advisories/sharp-multifunction-printers-local-file-inclusion-via-installed-emanual-down-html
Credits
Pierre Kim 🔍 The Shadowserver Foundation