CVE-2024-48870

high-risk

Published 2024-10-25

Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability. If crafted input is stored by an administrative user, malicious script may be executed on the web browsers of other victim users.

Do I need to act?

0.38% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.2/10 Medium

NETWORK / LOW complexity

Affected Products (20)

E-Studio1058 Firmware

E-Studio1208 Firmware

E-Studio908 Firmware

Bp-90C70 Firmware

Bp-90C80 Firmware

Bp-70C65 Firmware

Bp-70C55 Firmware

Bp-70C45 Firmware

Bp-70C36 Firmware

Bp-70C31 Firmware

Bp-60C45 Firmware

Bp-60C36 Firmware

Bp-60C31 Firmware

Bp-50C65 Firmware

Bp-50C55 Firmware

Bp-50C45 Firmware

Bp-50C36 Firmware

Bp-50C31 Firmware

Bp-50C26 Firmware

Bp-55C26 Firmware

Affected Vendors

Sharp Toshibatec

References (3)

Vendor Advisory https://global.sharp/products/copier/info/info_security_2024-10.html

Third Party Advisory https://jvn.jp/en/vu/JVNVU95063136/

Vendor Advisory https://www.toshibatec.com/information/20241025_01.html

/ 100

high-risk

Severity 23/34 · High

Exploitability 1/34 · Minimal

Exposure 33/34 · Critical