CVE-2024-47801

high-risk

Published 2024-10-25

Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, resulting in a reflected cross-site scripting vulnerability. Accessing a crafted URL which points to an affected product may cause malicious script executed on the web browser.

Do I need to act?

0.93% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.4/10 High

NETWORK / LOW complexity

Affected Products (20)

E-Studio1058 Firmware

E-Studio1208 Firmware

E-Studio908 Firmware

Bp-90C70 Firmware

Bp-90C80 Firmware

Bp-70C65 Firmware

Bp-70C55 Firmware

Bp-70C45 Firmware

Bp-70C36 Firmware

Bp-70C31 Firmware

Bp-60C45 Firmware

Bp-60C36 Firmware

Bp-60C31 Firmware

Bp-50C65 Firmware

Bp-50C55 Firmware

Bp-50C45 Firmware

Bp-50C36 Firmware

Bp-50C31 Firmware

Bp-50C26 Firmware

Bp-55C26 Firmware

Affected Vendors

Sharp Toshibatec

References (3)

Vendor Advisory https://global.sharp/products/copier/info/info_security_2024-10.html

Third Party Advisory https://jvn.jp/en/vu/JVNVU95063136/

Vendor Advisory https://www.toshibatec.com/information/20241025_01.html

/ 100

high-risk

Severity 26/34 · High

Exploitability 3/34 · Minimal

Exposure 33/34 · Critical