Medium severity · published Nov 26, 2024
CVE-2024-32151
User passwords are decrypted and stored on memory before any user logged in
5.9
CVSS
1.3%
EPSS
No
On KEV
Description
User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MM
Multiple MFPs (multifunction printers) · Sharp Corporation
See the information provided by Sharp Corporation listed under [References] · source: vendor
Affected product
MM
Multiple MFPs (multifunction printers)
Sharp Corporation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-32151
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-32151
global.sharp
https://global.sharp/products/copier/info/info_security_2024-05.html
jp.sharp
https://jp.sharp/business/print/information/info_security_2024-05.html
jvn.jp
https://jvn.jp/en/vu/JVNVU93051062/
pierrekim.github.io
https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html
www.toshibatec.co.jp
https://www.toshibatec.co.jp/information/20240531_02.html
www.toshibatec.com
https://www.toshibatec.com/information/20240531_02.html
More from Multiple MFPs (multifunction printers)
9.1
CVE-2024-36248
API keys for some cloud services are hardcoded in the "main" binary
9.1
CVE-2024-35244
There are several hidden accounts
9.1
CVE-2024-33610
"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication
9.0
CVE-2024-28038
The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow
7.5
CVE-2024-36254
Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lead to a denial-of-service (DoS)…