Description

Affected devices create coredump files when crashed, storing them with world-readable permission. Any local user of the device can examine the coredump files, and research the memory contents. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

Classification

CVE ID: CVE-2024-28955

CVSS Base Severity: MEDIUM

CVSS Base Score: 5.9

Affected Products

Vendor: Sharp Corporation

Product: Multiple MFPs (multifunction printers)

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.04% (probability of being exploited)

EPSS Percentile: 12.4% (scored less or equal to compared to others)

EPSS Date: 2025-02-03 (when was this score calculated)

References

https://global.sharp/products/copier/info/info_security_2024-05.html
https://jp.sharp/business/print/information/info_security_2024-05.html
https://www.toshibatec.com/information/20240531_02.html
https://www.toshibatec.co.jp/information/20240531_02.html
https://jvn.jp/en/vu/JVNVU93051062/
https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html

Timeline