CVE-2024-33605 Overview
CVE-2024-33605 is a path traversal vulnerability [CWE-22] in the installed_emanual_list.html endpoint exposed by Sharp and Toshiba Tec multifunction printers (MFPs). Improper processing of request parameters allows a remote, unauthenticated attacker to traverse the device file system and read files outside the intended directory. The flaw is reachable over the network without user interaction or privileges.
Critical Impact
Unauthenticated remote attackers can read sensitive files from affected Sharp and Toshiba Tec MFPs by manipulating parameters passed to installed_emanual_list.html.
Affected Products
- Sharp multifunction printer (MFP) firmware (see vendor advisory for model numbers and versions)
- Toshiba Tec multifunction printer firmware (see vendor advisory for model numbers and versions)
- Refer to JVN advisory JVNVU93051062 for the authoritative product list
Discovery Timeline
- 2024-06-27 - Technical analysis of Sharp MFP vulnerabilities published by Pierre Kim
- 2024-11-26 - CVE-2024-33605 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2024-33605
Vulnerability Analysis
The vulnerability resides in the web management interface served by affected Sharp and Toshiba Tec MFPs. The installed_emanual_list.html handler accepts one or more parameters that are used to construct a file path on the device. The handler fails to canonicalize and validate the supplied input before using it in file system operations.
An attacker who supplies traversal sequences such as ../ can escape the intended electronic manual directory and reference arbitrary files on the device. Because the endpoint is exposed over HTTP on the MFP management interface and does not require authentication, the attack can be conducted by any network-adjacent or internet-exposed client. Successful exploitation results in confidentiality impact only — file contents are exposed, but the flaw does not directly allow modification or denial of service per the published CVSS metrics.
Root Cause
The root cause is missing input validation on user-supplied parameters that are concatenated into a file path. The handler does not enforce an allowlist of expected filenames, does not reject path separator sequences, and does not normalize the resulting path before opening it. This is a textbook instance of CWE-22, Improper Limitation of a Pathname to a Restricted Directory.
Attack Vector
Exploitation requires only an HTTP request to the MFP's web interface. The attacker issues a GET request to installed_emanual_list.html with a crafted parameter containing relative path traversal sequences pointing at a target file outside the manuals directory. No credentials, prior access, or user action on the device is required. The vulnerability is described in detail in the Pierre Kim research blog on Sharp MFP vulnerabilities and the JVN Vulnerability Notice JVNVU93051062.
No verified proof-of-concept code is published in the enriched data. See the referenced advisories for technical reproduction details.
Detection Methods for CVE-2024-33605
Indicators of Compromise
- HTTP GET requests to installed_emanual_list.html on MFP management interfaces containing ../, ..\, URL-encoded %2e%2e%2f, or double-encoded traversal sequences in any query parameter.
- Requests to the MFP web interface from external IP addresses, scanning tools, or sources outside the printer management VLAN.
- Unexpected HTTP 200 responses from installed_emanual_list.html containing content that does not match the expected manual list format.
Detection Strategies
- Inspect web server and reverse-proxy logs in front of MFP interfaces for path traversal patterns targeting installed_emanual_list.html.
- Deploy network intrusion detection signatures that flag traversal payloads in HTTP request URIs and query strings sent to printer subnets.
- Compare current MFP firmware versions against the vendor advisories from Sharp and Toshiba Tec to identify unpatched assets.
Monitoring Recommendations
- Establish baseline traffic profiles for MFP management interfaces and alert on connections from non-administrative source networks.
- Aggregate printer access logs into a central SIEM or data lake for retention and correlation with other network events.
- Periodically scan internet-exposed ranges and internal segments for MFP web interfaces that should not be publicly reachable.
How to Mitigate CVE-2024-33605
Immediate Actions Required
- Apply the firmware updates referenced in the Sharp security advisory and the Toshiba Tec security advisory for affected models.
- Remove MFP management interfaces from the public internet and restrict access to a dedicated administrative VLAN.
- Inventory all Sharp and Toshiba Tec MFPs and confirm firmware versions against the lists in JVNVU93051062.
Patch Information
Sharp and Toshiba Tec have published firmware updates that address the improper parameter processing in installed_emanual_list.html. Affected model numbers and fixed firmware versions are enumerated in each vendor's advisory linked under External References. Operators should consult the vendor advisories directly because patched versions vary by model family and region.
Workarounds
- Block external access to TCP/80 and TCP/443 on MFP devices at the perimeter firewall until firmware is updated.
- Enforce access control lists on switches and firewalls that permit only authorized administrator workstations to reach printer management ports.
- Disable remote web administration on affected MFPs where firmware updates are not yet available, and require physical console or VPN access for management tasks.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
