Sharp Multifunction Printers: Unauthenticated local file inclusion via manual download

Summary

Sharp and rebranded Toshiba Tec multifunction printers contain a local file inclusion flaw in the installed_emanual_down.html endpoint of the web interface. An unauthenticated remote attacker can use directory traversal in the path parameter to read arbitrary files, including /etc/passwd, coredump files with credentials and system configuration files. The CVSS v4.0 base score is 8.7 (high), and exploitation requires no privileges or user interaction.

Affected

• Sharp Corporation multifunction printers (multiple models; exact version ranges unknown)
• Toshiba Tec Corporation multifunction printers rebranded from Sharp (exact version ranges unknown)
• Pierre Kim's research lists 308 Sharp MFP models as vulnerable to the wider set of issues

Fixed in

Unknown. No firmware version specifically addressing this CVE was identified.

Workaround

• Remove the printer web interface from internet access
• Restrict administrative web access to trusted subnets or a management VLAN
• Isolate MFPs with network segmentation
• Change passwords stored on the device

Exploitation

• Public proof of concept: a Nuclei template exists
• The CVE record states exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30 (not independently verified)
• CISA SSVC: exploitation status poc, automatable yes
• Sources conflict on in-the-wild exploitation; HOL Guard does not mark it as known exploited

Our recommendation

• Inventory all Sharp and Toshiba Tec MFPs, including models and firmware versions
• Check for external exposure of the web interface (ports 80 and 443) and block it at the firewall
• Restrict the web interface to a management VLAN
• Ask the vendor or local partner whether a firmware fix exists for specific models and record the answer
• Rotate admin and service account passwords after restricting access
• Review logs for requests to installed_emanual_down.html from unexpected sources
• Plan replacement of unsupported models

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Nuclei template crocus-lfi.yaml github.com
• Pierre Kim: 17 vulnerabilities in Sharp MFPs pierrekim.github.io
• VulnCheck advisory www.vulncheck.com
• OpenCVE CVE-2024-58388 app.opencve.io
• HOL Guard CVE-2024-58388 hol.org
• Securityonline: Sharp printer vulnerability CVE-2024-58388 securityonline.info
• Pierre Kim text advisory pierrekim.github.io
• Intruder CVE Monitor CVE-2024-58388 cvemon.intruder.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:20.