Sharp vulnerabilities
We track 25 vulnerabilities in Sharp products across 60+ products. 25 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on December 22, 2025.
Latest Sharp vulnerabilities
- 9.8 Critical severity
Media Player MP-01: Missing Authentication for Critical Functionality
Missing Authentication for Critical Function vulnerability in Sharp Display Solutions Media Player MP-01 All Verisons allows a attacker may access to the web interface of the affected product without authentication and change settings or perform other operatio
- 9.8 Critical severity
NP-P502HL-2, NP-P502WL-2, NP-P502HLG-2…: Improper Validation of Integrity Check Value
Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run unauthorized firmware.
- 7.2 High severity
home 5G HR02: Improper Neutralization of Special Elements used in an OS Command
home 5G HR02 and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the configuration restore function. An arbitrary OS command may be executed with the root privilege by an administrative user.
- 9.8 Critical severity
home 5G HR02: Active Debug Code
Multiple SHARP routers leave the hidden debug function enabled. An arbitrary OS command may be executed with the root privilege by a remote unauthenticated attacker.
- 7.2 High severity
home 5G HR02: Improper Neutralization of Special Elements used in an OS Command
home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the HOST name configuration screen. An arbitrary OS command may be executed with the root privilege by an administrative user.
- 7.5 High severity
Multiple MFPs (multifunction printers): Out-of-bounds Read
Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lead to a denial-of-service (DoS) condition.
- 7.5 High severity
Multiple MFPs (multifunction printers): Out-of-bounds Read
The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash. More precisely, a crafted parameter to billcodedef_sub_sel.html is not processed properly and device-crash happens. As for the details of affect
- 7.4 High severity
Multiple MFPs (multifunction printers): Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers). If this vulnerability is exploited, an arbitrary script may be executed on the administrative page of the affected MFPs. As for
- 9.1 Critical severity
Multiple MFPs (multifunction printers): Use of Hard-coded Credentials
API keys for some cloud services are hardcoded in the "main" binary. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
- 9.1 Critical severity
Multiple MFPs (multifunction printers): Use of Hard-coded Credentials
There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by examining the coredump), these accounts can be used to re-configure the device. As for the details of affected product n
- 9.1 Critical severity
Multiple MFPs (multifunction printers): Authentication Bypass Using an Alternate Path or Channel
"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides logged-in users' session information including session cookies, and "sys_trayentryreboot.html" allows to reboot the device. As for the details
- 7.5 High severity
Multiple MFPs (multifunction printers): Improper Limitation of a Pathname to a Restricted Directory
Improper processing of some parameters of installed_emanual_list.html and installed_emanual_down.html leads to a path traversal vulnerability. As for the details of affected product names, model numbers, and versions, refer to the information provided by the r
- 9.0 Critical severity
Multiple MFPs (multifunction printers): Stack-based Buffer Overflow
The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More precisely, giving too long character string to MFPSESSIONID parameter results in a stack buffer overflow. As for the details of affected pro
- 8.1 High severity
Sharp Digital Full-color MFPs and Monochrome…: Exposed Dangerous Method or Function
Sharp and Toshiba Tec MFPs provide configuration related APIs. They are expected to be called by administrative users only, but insufficiently restricted. A non-administrative user may execute some configuration APIs.
- 7.5 High severity
Sharp Digital Full-color MFPs and Monochrome…: Out-of-bounds Read
Sharp and Toshiba Tec MFPs provide the web page to download data, where query parameters in HTTP requests are improperly processed and resulting in an Out-of-bounds Read vulnerability. Crafted HTTP requests may cause affected products crashed.
- 7.5 High severity
Sharp Digital Full-color MFPs and Monochrome…: Out-of-bounds Read
Sharp and Toshiba Tec MFPs improperly process HTTP request headers, resulting in an Out-of-bounds Read vulnerability. Crafted HTTP requests may cause affected products crashed.
- 7.5 High severity
Sharp Digital Full-color MFPs and Monochrome…: Out-of-bounds Read
Sharp and Toshiba Tec MFPs contain multiple Out-of-bounds Read vulnerabilities, due to improper processing of keyword search input and improper processing of SOAP messages. Crafted HTTP requests may cause affected products crashed.
- 7.8 High severity
bluview: Improper Physical Access Control
Certain software builds for the BLU View 2 and Sharp Rouvo V Android devices contain a vulnerable pre-installed app with a package name of com.evenwell.fqc (versionCode='9020801', versionName='9.0208.01' ; versionCode='9020913', versionName='9.0209.13' ; versi
- 8.8 High severity
Energy Management Controller with Cloud Services: Improper Neutralization of Special Elements used in an OS Command
Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary OS command on the affected product.
- 8.1 High severity
Energy Management Controller with Cloud Services: Server-Side Request Forgery
Server-side request forgery vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to send an arbitrary HTTP request (GET) from the affected product.
- 9.3 Critical severity
Energy Management Controller with Cloud Services: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary script on the web browser of the user who is accessing t
- 8.8 High severity
Energy Management Controller with Cloud Services: Missing Authentication for Critical Functionality
Improper authentication vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to access the affected product without authentication.
- 9.8 Critical severity
P403, P463, P553, P703, P801, X554UN, X464UN…: Improper Limitation of a Pathname to a Restricted Directory
Sharp NEC Displays (P403, P463, P553, P703, P801, X554UN, X464UN, X554UNS, X464UNV, X474HB, X464UNS, X554UNV, X555UNS, X555UNV, X754HB, X554HB, E705, E805, E905, UN551S, UN551VS, X551UHD, X651UHD, X841UHD, X981UHD, MD551C8) allows an attacker execute remote co
- 7.2 High severity
SHARP multifunction printers: Improper Neutralization of Special Elements used in a Command
Command injection vulnerability in nw_interface.html in SHARP multifunction printers (MFPs)'s Digital Full-color Multifunctional System 202 or earlier, 120 or earlier, 600 or earlier, 121 or earlier, 500 or earlier, 402 or earlier, 790 or earlier, and Digital
- 9.8 Critical severity
Crestron Multiple Products Command Injection Exploited
The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L