Medium severity · published Mar 25, 2026
CVE-2026-32326
SHARP routers do not perform authentication for some web APIs
5.7
CVSS
0.4%
EPSS
No
On KEV
Description
SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password of the device is left as the initial one, the device may be taken over.
CVSS vector
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
5M
5G Mobile Router SH-U01 · Sharp Corporation
S4.48.00 and earlier · source: vendor
PW
Pocket WiFi 5G A503SH · Sharp Corporation
S7.41.00 and earlier · source: vendor
SW
Speed Wi-Fi 5G X01 · Sharp Corporation
3RJP_2_03I and earlier · source: vendor
WS
Wi-Fi STATION SH-52A · Sharp Corporation
38JP_2_03J and earlier · source: vendor
WS
Wi-Fi STATION SH-52B · Sharp Corporation
S3.87.15 and earlierr · source: vendor
WS
Wi-Fi STATION SH-54C · Sharp Corporation
S6.64.00 and earlier · source: vendor
H5
home 5G HR01 · Sharp Corporation
38JP_0_490 and earlier · source: vendor
H5
home 5G HR02 · Sharp Corporation
S5.A1.00 and earlier · source: vendor