The vulnerability is an unauthenticated local file inclusion in Sharp and Toshiba Tec multifunction printers. The installed_emanual_down.html endpoint accepts a path parameter that can be crafted with directory traversal sequences such as path=/manual/../../../<path>. This allows an attacker to read files beyond the intended /manual directory, including /etc/passwd, core dump files that might contain clear‑text credentials, and various system configuration files. The weakness is a classic file‑system traversal flaw (CWE‑22) and enables a confidentiality breach by exposing arbitrary system files.

Affected devices include a range of Sharp Corporation multifunction printers and the rebranded Toshiba Tec multifunction printers. No specific firmware or serial number versions are listed, so any ship‑from‑vendor firmware before the vendor’s fix may be impacted. Organizations that operate these devices, especially on corporate intranets or shared printing services, should assume the flaw exists until verified patching is confirmed.

The CVSS score of 8.7 reflects a high‑severity flaw that does not require authentication and can compromise sensitive files. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed widespread exploitation yet. However, the Shadowserver Foundation reported successful exploitation on July 30, 2024, suggesting that the attack vector is a simple HTTP request to the exposed endpoint. The risk is therefore significant for any network that allows untrusted traffic to reach the printer’s web interface, particularly if the device is accessible from external or sub‑networks.