Sharp and Toshiba Tec rebranded multifunction printers contain an unauthenticated local file inclusion vulnerability (CVE-2024-58388) in the installed_emanual_down.html endpoint. Attackers can supply directory traversal sequences in the 'path' parameter (e.g., path=/manual/../../../<file>) to access files outside the intended manual directory. This allows reading of arbitrary files including sensitive system and credential files. The vulnerability has a CVSS 4.0 score of 8.7 (high severity) with network attack vector, no privileges or user interaction required, and high impact on confidentiality.

Successful exploitation allows remote unauthenticated attackers to read arbitrary files on affected multifunction printers, potentially exposing sensitive system information and credentials. This can lead to information disclosure that may facilitate further attacks or compromise of the device.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected printers and monitor for suspicious activity targeting the installed_emanual_down.html endpoint.