PT-2024-22642 · Toshiba · Sharp/Toshiba Tec Mfps

Pierre Barre · Published 2024-07-01 · Updated 2024-11-26 · CVE-2024-28955

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sharp/Toshiba Tec MFPs (affected versions not specified)

Description The issue allows any local user of the device to examine coredump files, which are stored with world-readable permission when the device crashes. This enables the user to research the memory contents. The flaw is related to incorrect permission assignment, potentially leading to unauthorized access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2024-28955

Affected Products

Sharp/Toshiba Tec Mfps

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-28955 · Security Note
• https://twitter.com/CVEnew/status/1861316567381791048 · Twitter Post
• https://t.me/proxy_bar/2143 · Telegram Post
• http://seclists.org/fulldisclosure/2024/Jul/0 · Note
• https://toshibatec.com/information/20240531_02.html · Note
• https://toshibatec.co.jp/information/20240531_02.html · Note
• https://twitter.com/oktsec/status/1861373737913708897 · Twitter Post
• https://global.sharp/products/copier/info/info_security_2024-05.html · Note
• https://jvn.jp/en/vu/JVNVU93051062 · Note
• https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html · Note
• https://jp.sharp/business/print/information/info_security_2024-05.html · Note