Headline

CVE-2022-45796: Sharp Corporation

Command injection vulnerability in nw_interface.html in SHARP multifunction printers (MFPs)'s Digital Full-color Multifunctional System 202 or earlier, 120 or earlier, 600 or earlier, 121 or earlier, 500 or earlier, 402 or earlier, 790 or earlier, and Digital Multifunctional System (Monochrome) 200 or earlier, 211 or earlier, 102 or earlier, 453 or earlier, 400 or earlier, 202 or earlier, 602 or earlier, 500 or earlier, 401 or earlier allows remote attackers to execute arbitrary commands via unspecified vectors.

1 year ago

CVE

Open in Source

#vulnerability #web #git #perl #auth #chrome

About Command Injection Security Vulnerability in SHARP Multifunctional Products (MFP)

Command injection security vulnerability was identified and may impact some MFPs that are not properly protected with a strong admin password and firewall. The following is a summary of the vulnerability, affected models, and countermeasures:

Vulnerability identification number

JVNVU#96195138 / CVE-2022-45796

Affected models and firmware version

See the separate table below.

Condition to enable attacks using this vulnerability

To enable attackers to successfully attack the MFP using this vulnerability, they require access to:

● Target MFP via network within firewall
● MFP administrator password

Possible impacts

If the above conditions are fulfilled, attackers may execute arbitrary command codes on the MFP.

Mitigation measures

To mitigate security risks and the command injection vulnerability, ensure to protect your MFPs and apply the following countermeasures.

● Change admin password from factory default and securely store and manage the password.
● Do not expose MFPs directly to the Internet. Connect them via a firewall or similar network appliance.

If the above countermeasures are not practiced, devices may be accessed by attackers and cause data leakage.

Countermeasure

Sharp released updated firmware to mitigate the command injection vulnerability. For details, consult your authorized Sharp service providers.

Acknowledgment

This vulnerability was reported by ZUSO Advanced Research Team in Taiwan. We truly appreciate their report.

Information

JVNVU#96195138 Command Injection vulnerability in SHARP Multifunctional Products (MFP):
https://jvn.jp/en/vu/JVNVU96195138/index.html
CVE: https://www.cve.org/CVERecord?id=CVE-2022-45796

■ Affected models and firmware versions

308 different models of Sharp Multi-Function Printers (MFP) are vulnerable to 18 different vulnerabilities including remote code execution, local file inclusion, credential disclosure, and more.