About Plural Security Vulnerabilities in SHARP Multifunctional Products (MFP)
The following security vulnerabilities were identified and may impact some MFPs that are not properly protected from outside the network with a strong admin password and/or firewall. The following is a summary of the vulnerabilities, affected models, and countermeasures:
Vulnerability identification numberJVNVU#95063136 / See the following Detailed Information of the vulnerabilities for the CVE numbersAffected models and firmware versionSee the separate table below.Detailed information of the vulnerabilitiesCVE-2024-42420: Some device web pages may cause device hang-up due to out-of-bounds memory reference
CVE-2024-43424: Some device web pages may cause device hang-up due to out-of-bounds memory reference
CVE-2024-45829: Some device web pages may cause device hang-up due to out-of-bounds memory reference
CVE-2024-45842: Some device web pages may cause path traversal attacks
CVE-2024-47005: Some device web pages have APIs that have improper access control authority
CVE-2024-47406: Some device web pages have an alternate path for bypassing authentication mechanism
CVE-2024-47549: Some web pages may be able to execute HTTP header injection
CVE-2024-47801: Some web pages may cause cross-site scripting attacks
CVE-2024-48870: Some web pages may cause cross-site scripting attacks
Condition to enable attacks using this vulnerabilityTo enable attackers to successfully attack the MFP using these vulnerabilities, the following conditions shall be fulfilled: ● The attacker is able to access the corporate network to which the MFP is connected
● The attacker knows the information that users cannot know through normal operation
Possible impactsIf the above conditions are fulfilled, attackers may be able to :
1. hang the MFP up using crafted HTTP request on the MFP web page
2. access part of the MFP functions with unintended authority
3. access to the MFP by bypassing its authentication mechanism on the MFP web page
4. embed a script that may lead to information disclosure, etc. in the MFP web page
Mitigation measuresTo mitigate the security risks, ensure to protect your MFPs and apply the following countermeasures: ● Change admin password from factory default and manage it appropriately.
● Do not connect MFPs directly to the Internet. Connect them via a firewall or similar network appliance.
● Restrict device web page access via password (enable [System Settings]-[Security Settings]-[Restrict Device Web Page Access Via Password]).
● Monitor the MFP periodically using the Audit Log functionality to see if suspicious access is observed.
If the above countermeasures are not practiced, devices may be accessed by attackers and cause data leakage. CountermeasureSee [Affected models and the status of countermeasures] below. Sharp released updated firmware to mitigate these vulnerabilities for the models listed in Table 1. Regarding the models listed in Table 2, all firmware versions are affected, however, firmware support has ended. Please implement the above mitigation measures or consider discontinuing use of the product or migrating to a successor model. For details, consult your authorized Sharp service providers.AcknowledgmentInformationJVNVU#95063136:
https://jvn.jp/en/vu/JVNVU95063136/index.html
CVE:
https://www.cve.org/CVERecord?id=CVE-2024-42420
https://www.cve.org/CVERecord?id=CVE-2024-43424
https://www.cve.org/CVERecord?id=CVE-2024-45829
https://www.cve.org/CVERecord?id=CVE-2024-45842
https://www.cve.org/CVERecord?id=CVE-2024-47005
https://www.cve.org/CVERecord?id=CVE-2024-47406
https://www.cve.org/CVERecord?id=CVE-2024-47549
https://www.cve.org/CVERecord?id=CVE-2024-47801
https://www.cve.org/CVERecord?id=CVE-2024-48870
■ Affected models and the status of countermeasures
Table 1: Countermeasure firmware is available for the following models:
CategoryModel name Firmware version affected (see note)
* Check the 2nd to 4th digits of the firmware version Digital Full-color Multifunctional SystemBP-90C70/BP-90C80
“210” or earlierBP-70C65/BP-70C55/BP-70C45/
BP-70C36/BP-70C31/
BP-60C45/BP-60C36/BP-60C31/
BP-50C65/BP-50C55/BP-50C45/
BP-50C36/BP-50C31/BP-50C26/
BP-55C26“320” or earlierMX-8081/MX-7081“160” or earlierMX-6071/MX-5071/MX-4071/
MX-3571/MX-3071/
MX-4061/MX-3561/MX-3061/
MX-6051/MX-5051/MX-4051/
MX-3551/MX-3051/MX-2651/
MX-6071S/MX-5071S/MX-4071S/
MX-3571S/MX-3071S
MX-4061S/MX-3561S/MX-3061S“613” or earlier
BP-30C25
BP-30C25Y
BP-30C25Z
BP-30C25T“130” or earlierMX-7580N/MX-6580N“503” or earlierMX-8090N/MX-7090N“405” or earlierMX-6070N/MX-5070N/MX-4070N/
MX-3570N/MX-3070N/
MX-4060N/MX-3560N/MX-3060N/
MX-6070V/MX-5070V/MX-4070V/
MX-3570V/MX-3070V/
MX-4060V/MX-3560V/MX-3060V/
MX-6070N A/MX-4070N A/MX-3070N A
MX-6070V A/MX-4070V A/MX-3070V A“802” or earlierMX-6050N/MX-5050N/
MX-4050N/MX-3550N/MX-3050N/
MX-6050V/MX-5050V/
MX-4050V/MX-3550V/MX-3050V/
MX-2630N/
MX-3050N A/
MX-3050V A“802” or earlierBP-C545WD/BP-C542WD/
BP-C535WD/BP-C533WD/
BP-C535WR/BP-C533WR“262” or earlierMX-C304W/MX-C303W/
MX-C304/MX-C303/
MX-C304WH/MX-C303WH“520” or earlierDigital Multifunctional System (Monochrome) BP-70M90/BP-70M75
“310” or earlierBP-70M65/BP-70M55/BP-70M45/
BP-70M36/BP-70M31/
BP-50M55/BP-50M50/BP-50M45/
BP-50M36/BP-50M31/BP-50M26
“320” or earlierMX-M1206/MX-M1056“200” or earlier
(with Data Security Kit MX-FR66U: “210” or earlier)MX-M7570/MX-M6570“456” or earlierMX-M6071/MX-M5071/MX-M4071/
MX-M3571/MX-M3071/
MX-M6051/MX-M5051/MX-M4051/
MX-M3551/MX-M3051/MX-M2651/
MX-M3571S/MX-M3071S/
MX-M6071S/MX-M5071S/MX-M4071S
“413” or earlierBP-30M35/BP-30M31/BP-30M28/
BP-30M35T/BP-30M31T/BP-30M28T“220” or earlierMX-B476W/MX-B376W/
MX-B456W/MX-B356W/
MX-B476WH/MX-B376WH/
MX-B456WH/MX-B356WH“413” or earlierMX-M905“612” or earlierMX-M6070/MX-M5070/MX-M4070/
MX-M3570/MX-M3070/
MX-M6050/MX-M5050/MX-M4050/
MX-M3550/MX-M3050/
MX-M2630/
MX-M6070 A/MX-M4070 A/MX-M3070 A/
MX-M3050 A/
MX-M2630 A“503” or earlierBP-B550WD/BP-B540WR/
BP-B547WD/BP-B537WR
“260” or earlierMX-B455W/MX-B355W/
MX-B455WZ/MX-B355WZ/
MX-B455WT/MX-B355WT“404” or earlier
(with Data Security Kit MX-FR59U: “405” or earlier)NOTE: Follow the steps to check firmware version of your MFP.
Administrator login is required:
● Select [Settings] icon from the operation panel.
If you are accessing the MFP from your PC within the network, you may access the MFP settings via Web browser by entering its IP address.
● Select [Status] tab.
Select [Firmware version].
● The 16-digit alphanumeric string after “BUNDLE” (two 8-digit alphanumeric strings connected with an underscore) is the firmware
version(e.g., 0510Z200_22040400).
Table 2: For the following models, possible impact Nos. 2 and 3 are not affected. Since the firmware support for these models has ended, please implement the above mitigation measures or consider discontinuing use of the product or migrating to a successor model:
CategoryModel name Digital Full-color Multifunctional SystemMX-7500N/MX-6500N
MX-7040N/MX-6240N
MX-5141N/MX-5140N/MX-4141N/MX-4140N/
MX-5141N A/MX-4140N A
MX-3640N/MX-3140N/MX-2640N/MX-3140N A/
MX-3640NR/MX-3140NR/MX-2640NR
MX-3116N/MX-2616N/
MX-3115N/MX-2615N/MX-2615 A
MX-5112N/MX-5111N/MX-5110N/MX-4112N/MX-4111N/MX-4110N
MX-3610N/MX-3110N/MX-2610N/MX-3110N A/MX-3610NR
MX-C301W/MX-C301
MX-3114N/MX-2614NMX-2314N/MX-2314NR
MX-3111U/MX-2310U/MX-2310R
MX-2010U/MX-1810U
MX-C401/DX-C401/DX-C401 J/MX-C400/DX-C400/
MX-C381/DX-C381/MX-C380/MX-C381B
MX-C312/MX-C311/DX-C311/DX-C311J/MX-C310/DX-C310/
MX-C400P/MX-C380P/
MX-C402SC/MX-C382SC/MX-C382SCB
MX-5001N/MX-5000N/MX-4101N/MX-4100N
MX-3100N/MX-3100G/MX-2600N/MX-2600G
MX-3101N/MX-2601N/MX-2301N
DX-2500N/DX-2000UDigital Multifunctional System (Monochrome) MX-M1205/MX-M1055MX-M1204/MX-M1054/MX-M904
MX-M754N/MX-M654N/MX-M754N A/MX-M654N A
MX-M565N/MX-M465N/MX-M365N/
MX-M465N A/MX-M365N AMX-M564N/MX-M464N/MX-M364N/MX-M564N A
MX-M356N/MX-M316N/MX-M315N/MX-M356U/MX-M315U/
MX-M266N/MX-M265N/MX-M265U/
MX-M315NE/MX-M265NE/
MX-M356NV/MX-M316NV/MX-M315NV/MX-M356UV/MX-M315UV/
MX-M266NV/MX-M265NV/MX-M265UV/
MX-M315NE/MX-M265NE/MX-M315V/MX-M265V
MX-M354N/MX-M314N/MX-M264N/
MX-M354U/MX-M314U/MX-M264U/
MX-M314NV/MX-M264NV/
MX-M354NR/MX-M314NR/MX-M264NR
MX-B402/MX-B382/
MX-B402P/MX-B382P/
MX-B402SC/MX-B382SC
MX-B401/MX-B381/
MX-B400P/MX-B380P
MX-M753N/MX-M753U/MX-M623N/MX-M623U
MX-M503N/MX-M453N/MX-M363N/MX-M283N/
MX-M503U/MX-M453U/MX-M363U