CVE-2024-45829

high-risk

Published 2024-10-25

Sharp and Toshiba Tec MFPs provide the web page to download data, where query parameters in HTTP requests are improperly processed and resulting in an Out-of-bounds Read vulnerability. Crafted HTTP requests may cause affected products crashed.

Do I need to act?

0.22% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.9/10 Medium

NETWORK / LOW complexity

Affected Products (20)

E-Studio1058 Firmware

E-Studio1208 Firmware

E-Studio908 Firmware

Bp-90C70 Firmware

Bp-90C80 Firmware

Bp-70C65 Firmware

Bp-70C55 Firmware

Bp-70C45 Firmware

Bp-70C36 Firmware

Bp-70C31 Firmware

Bp-60C45 Firmware

Bp-60C36 Firmware

Bp-60C31 Firmware

Bp-50C65 Firmware

Bp-50C55 Firmware

Bp-50C45 Firmware

Bp-50C36 Firmware

Bp-50C31 Firmware

Bp-50C26 Firmware

Bp-55C26 Firmware

Affected Vendors

Sharp Toshibatec

References (3)

Vendor Advisory https://global.sharp/products/copier/info/info_security_2024-10.html

Third Party Advisory https://jvn.jp/en/vu/JVNVU95063136/

Vendor Advisory https://www.toshibatec.com/information/20241025_01.html

/ 100

high-risk

Severity 20/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 33/34 · Critical