CVE-2024-33605 – This path traversal vulnerability in Sharp and ... (How to Fix)

Q: What is the severity of CVE-2024-33605?

CVE-2024-33605 has a CVSS score of 7.5 (HIGH). This path traversal vulnerability in Sharp and Toshiba multifunction printers allows attackers to access arbitrary files on the affected devices by manipulating parameters in the installed_emanual_list.html endpoint. Organizations using vulnerable Sharp and Toshiba MFP models are affected. The vulnerability could expose sensitive configuration files, credentials, or other system data.

📋 TL;DR

This path traversal vulnerability in Sharp and Toshiba multifunction printers allows attackers to access arbitrary files on the affected devices by manipulating parameters in the installed_emanual_list.html endpoint. Organizations using vulnerable Sharp and Toshiba MFP models are affected. The vulnerability could expose sensitive configuration files, credentials, or other system data.

💻 Affected Systems

Products:

Sharp multifunction printers
Toshiba multifunction printers

Versions: Multiple models and firmware versions - refer to vendor advisories for specific affected models

Operating Systems: Embedded printer OS

Default Config Vulnerable: ⚠️ Yes

Notes: Specific affected models listed in vendor advisories. Both Sharp and Toshiba MFPs with the vulnerable HTML endpoint are affected.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of the MFP device, extraction of administrative credentials, lateral movement to connected networks, and potential data exfiltration from the device's storage.

🟠

Likely Case

Unauthorized access to sensitive files on the MFP device including configuration files, logs, and potentially stored documents, leading to information disclosure.

🟢

If Mitigated

Limited impact with proper network segmentation and access controls preventing external attackers from reaching the vulnerable endpoint.

🌐 Internet-Facing: HIGH - Many MFPs are directly exposed to the internet for remote management, making them accessible to attackers worldwide.

🏢 Internal Only: MEDIUM - Internal attackers or compromised internal systems could exploit this to access sensitive files on MFPs.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

The vulnerability is publicly documented with proof-of-concept details available. Path traversal vulnerabilities are commonly exploited and require minimal technical skill.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Varies by model - check vendor-specific firmware updates

Vendor Advisory: https://global.sharp/products/copier/info/info_security_2024-05.html

Restart Required: Yes

Instructions:

1. Identify affected MFP models using vendor advisories. 2. Download latest firmware from vendor support sites. 3. Apply firmware update following vendor instructions. 4. Verify update completion and restart devices.

🔧 Temporary Workarounds

Network Access Restriction

linux

Block external access to MFP web interfaces using firewall rules

iptables -A INPUT -p tcp --dport 80 -s ! 192.168.1.0/24 -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! 192.168.1.0/24 -j DROP

Disable Remote Management

all

Turn off web interface or restrict to local network only

🧯 If You Can't Patch

Segment MFPs on isolated network VLANs with strict access controls
Implement WAF rules to block path traversal patterns to /installed_emanual_list.html

🔍 How to Verify

Check if Vulnerable:

Access http://[MFP_IP]/installed_emanual_list.html?file=../../../../etc/passwd and check if system files are returned

Check Version:

Check firmware version in MFP web interface under Settings > System Information

Verify Fix Applied:

Attempt the same path traversal after patching - should return error or sanitized response

📡 Detection & Monitoring

Log Indicators:

Multiple requests to installed_emanual_list.html with ../ patterns
Unusual file access patterns from external IPs

Network Indicators:

HTTP requests containing '..' or '../' patterns to MFP web interfaces
Traffic to MFPs from unexpected external sources

SIEM Query:

source="mfp_logs" AND uri="*installed_emanual_list.html*" AND (uri="*..*" OR uri="*../*")

📊 Metadata

CVE ID: CVE-2024-33605

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-22

Published: November 26, 2024

Last Updated: November 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-33605, you might also want to check these: