Sharp vulnerabilities

CVE-2026-63563 Medium · 6.5 CWE-1188 Aug 3, 2026

Insecure Default Initialization of Resource in Sharp Sharp MFPs

Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication feature disabled in the initial configuration. When used with the initial configuration, the address book editing and a range of features related to Document Filing can be accessed without user authentication. Products intended for the Japanese market are not affected.

CVE-2026-63545 Low · 2.4 CWE-459 Aug 3, 2026

Sharp and Toshiba Tec MFPs (multifunction printers) caches data internally when…

Sharp and Toshiba Tec MFPs (multifunction printers) caches data internally when printing, and leave them uncleared. They may be accessed later by other users.

CVE-2026-62416 Medium · 5.3 CWE-1188 Aug 3, 2026

Insecure Default Initialization of Resource in Sharp Network Scanner Tool Lite

Network Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation, with the initial configuration, require no authentication and accept files unlimitedly. When the affected products are used with the initial configuration, anyone can connect to them without authentication and upload files unlimitedly. This may cause a denial-of-service (DoS) condition on the PC. Furthermore, if a malicious file is uploaded, a PC user may be tricked to execute the file to attack other entities from that PC.

CVE-2026-60011 Medium · 5.3 CWE-425 Aug 3, 2026

Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests…

Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image data stored to the affected product.

CVE-2026-32326 Medium · 5.7 CWE-306 Mar 25, 2026

Missing Authentication for Critical Function in Sharp home 5G HR01

SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password of the device is left as the initial one, the device may be taken over.

CVE-2025-12049 Critical · 9.8 CWE-306 Dec 22, 2025

Missing Authentication for Critical Function in Sharp Mp-01 Firmware

Missing Authentication for Critical Function vulnerability in Sharp Display Solutions Media Player MP-01 All Verisons allows a attacker may access to the web interface of the affected product without authentication and change settings or perform other operations, and deliver content from the authoring software to the affected product without authentication.

CVE-2025-11543 Critical · 9.8 CWE-354 Dec 22, 2025

Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions…

Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run unauthorized firmware.

CVE-2025-11542 Critical · 9.8 CWE-787 Dec 22, 2025

Out-of-bounds Write in Sharp Np-p502h Firmware

Stack-based Buffer Overflow vulnerability in Sharp Display Solutions projectors allows a attacker may execute arbitrary commands and programs.

CVE-2025-11541 Critical · 9.8 CWE-787 Dec 22, 2025

Out-of-bounds Write in Sharp Np-p502h Firmware

Stack-based Buffer Overflow vulnerability in Sharp Display Solutions projectors allows a attacker may execute arbitrary commands and programs.

CVE-2025-11540 High · 7.5 CWE-22 Dec 22, 2025

Path Traversal in Sharp Np-p502h Firmware

Path Traversal vulnerability in Sharp Display Solutions projectors allows a attacker may access and read any files within the projector.

CVE-2019-3929 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-78 Apr 30, 2019

Crestron Multiple Products Command Injection Vulnerability

The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro firmware 1.0.0.5, Blackbox HD WPS firmware 1.0.0.5, InFocus LiteShow3 firmware 1.0.16, and InFocus LiteShow4 2.0.0.7 are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.