CVE-2024-34162: The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP...
Description
The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authentication to "SIMPLE", the device communicates with the LDAP server in clear-text. The LDAP password can be retrieved from this clear-text communication. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
Classification
CVE ID: CVE-2024-34162
CVSS Base Severity: MEDIUM
CVSS Base Score: 5.3
Affected Products
Vendor: Sharp Corporation
Product: Multiple MFPs (multifunction printers)
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 12.38% (scored less or equal to compared to others)
EPSS Date: 2025-02-03 (when was this score calculated)
References
https://global.sharp/products/copier/info/info_security_2024-05.htmlhttps://jp.sharp/business/print/information/info_security_2024-05.html
https://www.toshibatec.com/information/20240531_02.html
https://www.toshibatec.co.jp/information/20240531_02.html
https://jvn.jp/en/vu/JVNVU93051062/
https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html