PT-2024-26933 · Sharp+1 · Multiple Mfps+18

Jarrod Stebick · Published 2024-11-26 · Updated 2024-12-01 · CVE-2024-36251

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Affected devices (affected versions not specified)

Description The web interface of the affected devices processes some crafted HTTP requests improperly, leading to a device crash. More precisely, a crafted parameter to billcodedef sub sel.html is not processed properly, causing the device to crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2024-36251

Affected Products

Multiple Mfps

Bp-B537Wr

Bp-B540Wr

Bp-B547Wd

Bp-B550Wd

Mx-B355W

Mx-B455W

Mx-M2630

Mx-M3050

Mx-M3070

Mx-M3550

Mx-M3570

Mx-M4050

Mx-M4070

Mx-M5050

Mx-M5070

Mx-M6050

Mx-M6070

Mx-M905

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-36251 · Security Note
• http://seclists.org/fulldisclosure/2024/Jul/0 · Note
• https://twitter.com/CVEnew/status/1861316555306361000 · Twitter Post
• https://toshibatec.com/information/20240531_02.html · Note
• https://twitter.com/cracbot/status/1863100858604597434 · Twitter Post
• https://toshibatec.co.jp/information/20240531_02.html · Note
• https://global.sharp/products/copier/info/info_security_2024-05.html · Note
• https://jvn.jp/en/vu/JVNVU93051062 · Note
• https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html · Note
• https://jp.sharp/business/print/information/info_security_2024-05.html · Note