Technical impact
The vulnerability in Sharp and Toshiba Tec multifunction printers permits an attacker to directly retrieve image data stored on the device without proper authorization. This flaw undermines the confidentiality of user‑generated documents, allowing a potential attacker to read or download private images that were captured or scanned. The weakness is a classic authorization issue, corresponding to CWE-425, which states that a system fails to enforce proper access control on a resource.
Affected Systems
Sharp Corporation’s Sharp MFP line and Toshiba Tec Corporation’s Toshiba Tec MFP line are affected. The advisory does not list specific firmware or hardware revisions, so it is presumed that all current models supporting image retrieval are vulnerable.
Risk and Exploitability
The CVSS score of 6.9 places the flaw in the medium severity range, and the lack of a public exploit or listing in the KEV catalog suggests that active exploitation is limited at present. However, the vulnerability can be triggered by any user with network or local access to the printer’s control interface, so attackers could potentially retrieve photos or scans by sending specially crafted requests. Because the EPSS score is not available, the exact probability of exploitation remains uncertain, but the medium CVSS score and the nature of the flaw warrant prompt remediation.
