API keys for some cloud services are hardcoded in the "main" binary

There are several hidden accounts

"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication

The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow

Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lead to a denial-of-service (DoS)…

The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash

Improper processing of some parameters of installed_emanual_list.html leads to a path traversal vulnerability

Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers)

User passwords are decrypted and stored on memory before any user logged in

User passwords are decrypted and stored on memory before any user logged in

User passwords are decrypted and stored on memory before any user logged in

Affected devices create coredump files when crashed, storing them with world-readable permission

The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users

Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege