CVE-2024-58388

Name of the Vulnerable Software and Affected Versions Sharp and Toshiba Tec rebranded multifunction printers (affected versions not specified)

Description An unauthenticated local file inclusion issue exists, allowing remote attackers to read arbitrary files. By manipulating the path parameter in the 'installed emanual down.html' endpoint, attackers can use directory traversal sequences to access files outside the intended manual directory, such as /etc/passwd, system configuration files, and coredump files containing credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.