CVE-2024-33616

Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege. Sharp Corporation states the telnet feature is implemented on older models only, and is planning to provide the firmware update to remove the feature. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://global.sharp/products/copier/info/info_security_2024-05.html
https://jp.sharp/business/print/information/info_security_2024-05.html
https://jvn.jp/en/vu/JVNVU93051062/
https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html
https://www.toshibatec.co.jp/information/20240531_02.html
https://www.toshibatec.com/information/20240531_02.html

Configurations

No configuration.

History

10 Dec 2024, 16:15

Type	Values Removed	Values Added
Summary		(es) La autenticación de administrador se puede omitir con algunas credenciales no válidas específicas, lo que permite iniciar sesión con privilegios administrativos. Sharp Corporation afirma que la función Telnet está implementada solo en modelos más antiguos y planea proporcionar la actualización de firmware para eliminar la función. En cuanto a los detalles de los nombres de los productos afectados, los números de modelo y las versiones, consulte la información proporcionada por los respectivos proveedores que se enumeran en [Referencias].
CWE		CWE-306

26 Nov 2024, 08:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-11-26 08:15

Updated : 2024-12-10 16:15

NVD link : CVE-2024-33616

Mitre link : CVE-2024-33616

CVE.ORG link : CVE-2024-33616

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2024-33616", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-11-26T08:15:05.987", "references": [{"url": "https://global.sharp/products/copier/info/info_security_2024-05.html", "source": "vultures@jpcert.or.jp"}, {"url": "https://jp.sharp/business/print/information/info_security_2024-05.html", "source": "vultures@jpcert.or.jp"}, {"url": "https://jvn.jp/en/vu/JVNVU93051062/", "source": "vultures@jpcert.or.jp"}, {"url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html", "source": "vultures@jpcert.or.jp"}, {"url": "https://www.toshibatec.co.jp/information/20240531_02.html", "source": "vultures@jpcert.or.jp"}, {"url": "https://www.toshibatec.com/information/20240531_02.html", "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege. Sharp Corporation states the telnet feature is implemented on older models only, and is planning to provide the firmware update to remove the feature. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."}, {"lang": "es", "value": "La autenticaci\u00f3n de administrador se puede omitir con algunas credenciales no v\u00e1lidas espec\u00edficas, lo que permite iniciar sesi\u00f3n con privilegios administrativos. Sharp Corporation afirma que la funci\u00f3n Telnet est\u00e1 implementada solo en modelos m\u00e1s antiguos y planea proporcionar la actualizaci\u00f3n de firmware para eliminar la funci\u00f3n. En cuanto a los detalles de los nombres de los productos afectados, los n\u00fameros de modelo y las versiones, consulte la informaci\u00f3n proporcionada por los respectivos proveedores que se enumeran en [Referencias]."}], "lastModified": "2024-12-10T16:15:23.160", "sourceIdentifier": "vultures@jpcert.or.jp"}