جزئیات آسیب‌پذیری
CVE-2024-36251
Sharp Multiple MFPsToshiba Tec Multiple MFPssharp bp-b537wrsharp bp-b540wrsharp bp-b547wdsharp bp-b550wd
CVSS 3.1
7.5بالا
شرح رسمی (انگلیسی)
The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash. More precisely, a crafted parameter to billcodedef_sub_sel.html is not processed properly and device-crash happens. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 7.5بالا | 3.1 | CVEProject cvelistV5 (CNA) (jpcert) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Sharp Corporation | Multiple MFPs (multifunction printers) | See the information provided by Sharp Corporation listed under [References] | CVEProject cvelistV5 (CNA) |
| Toshiba Tec Corporation | Multiple MFPs (multifunction printers) | See the information provided by Toshiba Tec Corporation listed under [References] | CVEProject cvelistV5 (CNA) |
| sharp | bp-b537wr | 250 | CISA ADP / Vulnrichment |
| sharp | bp-b540wr | 250 | CISA ADP / Vulnrichment |
| sharp | bp-b547wd | 250 | CISA ADP / Vulnrichment |
| sharp | bp-b550wd | 250 | CISA ADP / Vulnrichment |
| sharp | mx-b355w | 404 | CISA ADP / Vulnrichment |
| sharp | mx-b355wt | 404 | CISA ADP / Vulnrichment |
| sharp | mx-b355wz | 404 | CISA ADP / Vulnrichment |
| sharp | mx-b455w | 404 | CISA ADP / Vulnrichment |
| sharp | mx-b455wt | 404 | CISA ADP / Vulnrichment |
| sharp | mx-b455wz | 404 | CISA ADP / Vulnrichment |
| sharp | mx-m2630 | 502 | CISA ADP / Vulnrichment |
| sharp | mx-m3050 | 502 | CISA ADP / Vulnrichment |
| sharp | mx-m3070 | 502 | CISA ADP / Vulnrichment |
| sharp | mx-m3550 | 502 | CISA ADP / Vulnrichment |
| sharp | mx-m3570 | 502 | CISA ADP / Vulnrichment |
| sharp | mx-m4050 | 502 | CISA ADP / Vulnrichment |
| sharp | mx-m4070 | 502 | CISA ADP / Vulnrichment |
| sharp | mx-m5050 | 502 | CISA ADP / Vulnrichment |
| sharp | mx-m5070 | 502 | CISA ADP / Vulnrichment |
| sharp | mx-m6050 | 502 | CISA ADP / Vulnrichment |
| sharp | mx-m6070 | 502 | CISA ADP / Vulnrichment |
| sharp | mx-m6070 | 502 | CISA ADP / Vulnrichment |
| sharp | mx-m905 | 611 | CISA ADP / Vulnrichment |
منابع و راهنماها
۷- https://global.sharp/products/copier/info/info_security_2024-05.html
- https://jp.sharp/business/print/information/info_security_2024-05.html
- https://www.toshibatec.com/information/20240531_02.html
- https://www.toshibatec.co.jp/information/20240531_02.html
- https://jvn.jp/en/vu/JVNVU93051062/
- https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html
- http://seclists.org/fulldisclosure/2024/Jul/0
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۳/۰۹/۰۶
- آخرین به‌روزرسانی
- ۱۴۰۴/۰۸/۱۳
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- jpcert
پیش‌بینی بهره‌برداری (EPSS)
۳٫۴۹٪
احتمال بهره‌برداری در ۳۰ روز
۸۹٫۱٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- بله
- وضعیت بهره‌برداری
- اثبات مفهوم
- اثر فنی
- جزئی
ضعف‌ها (CWE)
- CWE-125Out-of-bounds read