CVE-2024-58388

CVE-2024-58388 is an unauthenticated local file inclusion (LFI) and path traversal vulnerability affecting multiple Sharp multifunction printers, as well as rebranded Toshiba Tec models. The flaw resides in the printer's web manual download page, specifically within the `installed_emanual_down.html` endpoint, where the system fails to properly restrict or validate the file path parameter. By manipulating this parameter with directory traversal sequences (such as `path=/manual/../../../<path>`), a remote attacker can bypass directory restrictions without needing to authenticate. This allows them to access and read arbitrary files outside the intended manual directory, including system configuration files, `/etc/passwd`, and coredump files that may contain stored credentials. A proof-of-concept (PoC) for this vulnerability was publicly disclosed in June 2024, and active exploitation in the wild was first observed by the Shadowserver Foundation in late July 2024. Despite this early activity, the CVE was officially published in October 2026. To mitigate the risk, organizations are advised to apply the latest firmware updates from Sharp or Toshiba Tec, restrict printer web interfaces from being exposed to the public internet, limit administrative panel access to trusted subnets, and change any passwords stored on the affected devices.