Unprotected Session Information and Reboot Capabilities Exposed
CVE-2024-33610

9.1CRITICAL

Key Information:

Vendor

Sharp Corporation

Status
Multiple Mfps (multifunction Printers)
Vendor
CVE Published:
26 November 2024

What is CVE-2024-33610?

The vulnerability described in CVE-2024-33610 affects select Sharp and Toshiba multifunction printers, where specific HTML pages such as 'sessionlist.html' and 'sys_trayentryreboot.html' are accessible without authentication. The 'sessionlist.html' page can expose sensitive session information, including session cookies of logged-in users, while 'sys_trayentryreboot.html' functions allow unauthorized users to reboot the printer devices. This could lead to potential unauthorized control over the device and session hijacking, posing significant security risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Multiple MFPs (multifunction printers) See the information provided by Sharp Corporation listed under [References]

Multiple MFPs (multifunction printers) See the information provided by Toshiba Tec Corporation listed under [References]

References

https://global.sharp/products/copier/info/info_security_2...
https://jp.sharp/business/print/information/info_security...
https://www.toshibatec.com/information/20240531_02.html

EPSS Score

59% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.