VulnerabilityPublished 26 Nov 2024Updated 4 Nov 2025

CVE-2024-34162: Sharp Multiple MFPs (multifunction printers) · Access to critical private variable via public method

Affects Sharp Multiple MFPs (multifunction printers)Source CVE Database V5

Not known to be exploited · CVSS 5.3 Medium.

Data as of 26 Oct 2026, 11:07 UTC

CVSS 3.1 base score

5.3Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.7% chance of exploitation in 30 days – higher than 55% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 26 Nov 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

Immediately review and change LDAP authentication settings on all Sharp MFPs to avoid using SIMPLE authentication.
Configure LDAP communication to use encrypted protocols such as LDAPS (LDAP over SSL/TLS) or StartTLS to ensure credentials are never transmitted in clear-text.
Apply any firmware updates or patches provided by Sharp Corporation as soon as they become available, referencing official vendor advisories.
Segment network access to MFP devices, restricting communication to trusted management and directory servers only.
Monitor network traffic for signs of clear-text LDAP credential transmission and anomalous access patterns to LDAP servers.
Conduct regular security audits of MFP configurations and network architecture to ensure compliance with secure authentication practices.
Educate IT staff and administrators about the risks of unencrypted LDAP and enforce policies that prohibit SIMPLE authentication in production environments.
Consider deploying network intrusion detection systems (NIDS) capable of detecting LDAP credential leakage or suspicious LDAP traffic.
If possible, replace or upgrade legacy devices that do not support secure LDAP protocols.
Maintain an inventory of all Sharp MFPs and their firmware versions to prioritize remediation efforts.

Description

The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authentication to "SIMPLE", the device communicates with the LDAP server in clear-text. The LDAP password can be retrieved from this clear-text communication. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

Impact

For European organizations, this vulnerability poses a risk of credential disclosure that could lead to unauthorized access to corporate directory services, such as Microsoft Active Directory or other LDAP-based authentication systems. Since multifunction printers are often deployed in office environments and connected to internal networks, an attacker who gains network access—either physically or via compromised network segments—could intercept LDAP credentials transmitted in clear-text. This could facilitate lateral movement, privilege escalation, or data exfiltration within the organization. The impact is particularly significant for organizations with strict data protection requirements under GDPR, as unauthorized access to directory services may lead to exposure of personal data or disruption of authentication services. Additionally, sectors with high security needs such as government, finance, healthcare, and critical infrastructure in Europe could face increased risk if their Sharp MFPs are affected and improperly configured. However, since the vulnerability does not directly affect device integrity or availability, the immediate operational impact is limited to confidentiality breaches. The absence of known exploits reduces immediate risk but does not eliminate the potential for future attacks.

Summary

CVE-2024-34162 is a vulnerability identified in multiple Sharp Corporation multifunction printers (MFPs) involving the handling of LDAP authentication credentials. The affected devices' web interfaces are designed to conceal LDAP credentials even from administrative users; however, when LDAP authentication is configured to use the SIMPLE method, the device communicates with the LDAP server without encryption, transmitting credentials in clear-text. This exposure allows an attacker with network access to intercept and retrieve the LDAP password by capturing the network traffic between the MFP and the LDAP server. The vulnerability does not require any prior authentication or user interaction, making it accessible to remote attackers who can observe the network segment. The CVSS 3.1 base score is 5.3 (medium severity), reflecting the network attack vector, low complexity, no privileges required, no user interaction, and limited impact confined to confidentiality loss of LDAP credentials. The integrity and availability of the device or network are not directly affected. The affected product versions are detailed by Sharp Corporation but generally include multiple MFP models. No public exploits have been reported yet. This vulnerability primarily threatens the confidentiality of LDAP credentials, which could be leveraged to gain unauthorized access to directory services, potentially leading to further network compromise or data exposure. The root cause is the use of unencrypted LDAP SIMPLE authentication, which is a known insecure practice. Properly configured encrypted LDAP methods such as LDAPS or StartTLS would mitigate this risk.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 4 Nov 2025, 17:53 UTC

Technical details

References

Community reviews

Related threats