This vulnerability arises because certain Sharp and Toshiba Tec multifunction printers ship with the user authentication feature disabled by default. As a result, any user on the local or network interface can edit the device address book and manipulate document filing functions without providing credentials. The lack of authentication permits abuse of these internal features, potentially allowing an attacker to create, modify, or delete entries used for document routing, and to change filing configurations that could redirect documents to malicious destinations. The weakness is classified as CWE‑1188, indicating a feature that should have been protected but is left insecure.

The affected products are Sharp MFPs and Toshiba Tec MFPs intended for markets outside the Japanese market. Devices shipped with the initial configuration that has authentication disabled are vulnerable. Those intended for the Japanese market are not affected. Specific model or firmware version information is not provided in the advisory.

The published CVSS score is 6.9, placing the vulnerability in the high severity range. No EPSS score is available, so the exact likelihood of exploitation is unknown. The vulnerability is not listed in CISA’s KEV catalog. Inference from the description indicates that an attacker with network or local access can exploit the flaw without needing to perform additional compromises—simply by sending configuration requests to the device’s management interface. The impact is limited to the features enabled for address book editing and document filing, but because these functions often control routing and storage, the potential for data exfiltration or policy bypass is significant.