CVE-2024-47005Network attack vector

Non-admin configuration access via underrestricted web APIs

Published Oct 25, 2024 · Updated Oct 25, 2024

Improper access control in Sharp and Toshiba Tec MFP firmware allows remote authenticated users to execute administrative configuration APIs. The device web interface fails to enforce administrative authorization on a subset of configuration-related API calls; individual API names are undisclosed. Exploitation requires a non-administrative account, corporate-network access, and information unavailable through normal operation, and grants only the exposed configuration functions.

CVSS severity8.1
High
EPSS probability0.46%
Next 30 days · Sep 16, 2026
Known exploitationUnconfirmed
Based on sourced intelligence
Hinoki checkNot available
Coverage for this vulnerability

See if you're affected

Explore vulnerability checks for your environment with Hinoki.

Book a demo

Summary

What happened

Improper access control in Sharp and Toshiba Tec MFP firmware allows remote authenticated users to execute administrative configuration APIs. The device web interface fails to enforce administrative authorization on a subset of configuration-related API calls; individual API names are undisclosed. Exploitation requires a non-administrative account, corporate-network access, and information unavailable through normal operation, and grants only the exposed configuration functions.

The record

CVE
CVE-2024-47005
Published
Oct 25, 2024
Updated
Oct 25, 2024
Vendor
Sharp Corporation
Product
BP-70M90 Firmware
Classifications
CWE-749, T1210
Attack vector
network
Privileges
authenticated

Timeline

How it unfolded

  1. Oct 25, 2024CVE publishedPublication date reported by the CVE source.
  2. Oct 25, 2024Record updatedLatest update available in the CVE record.

Exploitability

Present is not the same as exploitable

Compare your product and version with the public record. A matching version still requires validation against your environment.

Is a vulnerable build present?

Compare these published version ranges with your installed build and any vendor patches.

  1. Affected versionversion=0 <=310

What conditions does exploitation require?

Attack vectornetwork
Required privilegesauthenticated

What is affected?

Sharp Corporation · BP-70M90 Firmwareversion=0 <=310
Sharp Corporation · MX-M7570 Firmwareversion=0 <=456
Sharp Corporation · MX-M6071S Firmwareversion=0 <=413
Sharp Corporation · MX-6071S Firmwareversion=0 <=613
Toshiba Tec Corporation · e-STUDIO 908 Firmwareversion=0 <=t2.12.h3.00
Sharp Corporation · MX-M1206 Firmwareversion=0 <=200
Toshiba Tec Corporation · e-STUDIO908version=T2.12.h3.00 and earlier versions
Sharp Corporation · MX-C304WH Firmwareversion=0 <=520
Sharp Corporation · BP-70M65 Firmwareversion=0 <=320
Sharp Corporation · MX-6070V Firmwareversion=0 <=802
Toshiba Tec Corporation · e-STUDIO1208version=T1.01.h4.00 and earlier versions
Sharp Corporation · MX-8081 Firmwareversion=0 <=160
Toshiba Tec Corporation · e-STUDIO 1208 Firmwareversion=0 <=t1.01.h4.00
Sharp Corporation · Sharp MX-M905 Firmwareversion=0 <=612
Sharp Corporation · BP-B550WD Firmwareversion=0 <=260
Sharp Corporation · MX-7580N Firmwareversion=0 <=503
Sharp Corporation · MX-M6070 Firmwareversion=0 <=503
Sharp Corporation · MX-B455WZ Firmwareversion=0 <=404
Toshiba Tec Corporation · e-STUDIO 1058 Firmwareversion=0 <=t1.01.h4.00
Sharp Corporation · MX-8090N Firmwareversion=0 <=405
Sharp Corporation · BP-90C80 Firmwareversion=0 <=210
Sharp Corporation · BP-70C65 Firmwareversion=0 <=320
Toshiba Tec Corporation · e-STUDIO1058version=T1.01.h4.00 and earlier versions
Sharp Corporation · BP-30C25 Firmwareversion=0 <=130
Sharp Corporation · MX-B476WH Firmwareversion=0 <=413
Sharp Corporation · BP-C545WD Firmwareversion=0 <=262
Sharp Corporation · BP-30M35T Firmwareversion=0 <=220

Published CVSS scores

8.1JPCERT/CCCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CVSS describes severity. EPSS estimates exploitation probability.

Attacks

What attackers are doing with it

Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.

Daily unique IPsNo honeypot observations are available for this CVE in the selected window.

No observations available

Sep 10, 2026Sep 16, 2026
Latest reporting daySep 16, 2026
Latest daily unique IPsUnavailable
Prior 30-day averageUnavailable
SourceShadowserver honeypots (KEV)
Vectornetwork
Privilegesauthenticated
Known exploitationUnconfirmed
Public exploitUnconfirmed

Weakness, pattern, technique

CWE-749Exposed Dangerous Method or Function
T1210Exploitation of Remote Services

Public exploit references

No public exploit references are available in this record.

Labels summarize the accepted research assessment. They do not indicate a test against your environment.

Technologies

Your stack

See the directory against your own environment.

Your stack

Check the software in your environment

Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.

Book a demo