CVE-2024-58388

Summary

A local file inclusion vulnerability in Sharp and Toshiba Tec multifunction printers allows remote attackers to read arbitrary files without authentication by manipulating the path parameter in the installed_emanual_down.html endpoint. This flaw can expose sensitive system files like /etc/passwd and coredump files containing credentials.

Exploitability

The vulnerability is easily exploitable with no authentication required, allowing attackers to perform directory traversal attacks against the affected printers' web interface.

Blast radius

Multiple printers across a network could be compromised simultaneously, potentially exposing credentials, system configurations, and sensitive data from all affected devices.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version 2.590 or later to address this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.