CVE-2024-48870

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-25 · updated 2026-06-17
Weakness: CWE-79

Description

Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability. If crafted input is stored by an administrative user, malicious script may be executed on the web browsers of other victim users.

Affected products

SHARP Bp-30C25 Firmware: all versions
SHARP Bp-30C25T Firmware: all versions
SHARP Bp-30C25Y Firmware: all versions
SHARP Bp-30C25Z Firmware: all versions
SHARP Bp-30M28 Firmware: all versions
SHARP Bp-30M28T Firmware: all versions
SHARP Bp-30M31 Firmware: all versions
SHARP Bp-30M31T Firmware: all versions
SHARP Bp-30M35 Firmware: all versions
SHARP Bp-30M35T Firmware: all versions
SHARP Bp-50C26 Firmware: all versions
SHARP Bp-50C31 Firmware: all versions
SHARP Bp-50C36 Firmware: all versions
SHARP Bp-50C45 Firmware: all versions
SHARP Bp-50C55 Firmware: all versions
SHARP Bp-50C65 Firmware: all versions
SHARP Bp-50M26 Firmware: all versions
SHARP Bp-50M31 Firmware: all versions
SHARP Bp-50M36 Firmware: all versions
SHARP Bp-50M45 Firmware: all versions
SHARP Bp-50M50 Firmware: all versions
SHARP Bp-50M55 Firmware: all versions
SHARP Bp-55C26 Firmware: all versions
SHARP Bp-60C31 Firmware: all versions
SHARP Bp-60C36 Firmware: all versions
SHARP Bp-60C45 Firmware: all versions
SHARP Bp-70C31 Firmware: all versions
SHARP Bp-70C36 Firmware: all versions
SHARP Bp-70C45 Firmware: all versions
SHARP Bp-70C55 Firmware: all versions

References

https://global.sharp/products/copier/info/info_security_2024-10.html
https://jvn.jp/en/vu/JVNVU95063136/
https://www.toshibatec.com/information/20241025_01.html

Get alerted when CVE-2024-48870 or the next vulnerability affects your stack