JVNDB-2022-002780

Command injection vulnerability in SHARP Multifunctional Products (MFP)

SHARP Multifunctional Products (MFP) contain a command injection vulnerability (CWE-77, CVE-2022-45796).

The OS layer is affected beyond the web application component, however treating the web application component as separate from the OS layer, 'Scope' is analyzed as 'S:C'.

Sharp reported this vulnerability to JPCERT/CC to notify users of its solution through JVN.

Sharp Corporation

• (Multiple Products)

A wide range of product models and firmware versions is affected by this vulnerability. For more information, refer to the information provided by the developer.

* Digital Full-color Multifunctional System
* Digital Multifunctional System (Monochrome)

If this vulnerability is exploited, an arbitrary command may be executed on the affected MFP firmware.

The developer states that the followings are the prerequisites to exploit this vulnerability.

* A remote attacker has access to the affected MFPs via network
* A remote attacker is authenticated with the administrative privileges of the affected MFPs

For more information, refer to the information provided by the developer.

[Update the firmware]
Apply the appropriate firmware update according to the information provided by the developer.
For the details such as how to update the firmware and/or where to obtain the firmware update, refer to Sharp Corporation - Sharp Global Support page.

[Apply workaround]
Applying the following workarounds may mitigate the impact of this vulnerability.

* Connect MFPs to the internet under the securely protected network such as using a firewall or similar network appliance
* Change the factory-shipped default administrative password, and manage it appropriately

For the details of workarounds, refer to Sharp Corporation - Sharp Global Support page.

Sharp Corporation

• Sharp Corporation : About Command Injection Security Vulnerability in SHARP Multifunctional Products (MFP)

1. Command Injection(CWE-77) [Other]

1. CVE-2022-45796

1. JVN : JVNVU#96195138
2. National Vulnerability Database (NVD) : CVE-2022-45796
3. Related document : SHARP Multifunction Printer - Command Injection

• [2022/12/20]
    Web page was published