CVE-2024-33610
"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides logged-in users' session information including session cookies, and "sys_trayentryreboot.html" allows to reboot the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- EPSS probability
- 50.02%
- CWE
- CWE-288
- Published
- 2024-11-26
- Last modified
- 2026-03-13
Affected products
- Sharp Corporation Multiple MFPs (multifunction printers)
- Toshiba Tec Corporation Multiple MFPs (multifunction printers)
Weakness type
Related vulnerabilities
- CVE-2026-81796 — WordPress WP Travel plugin <= 12.0.3 - Broken Authentication vulnerability
- CVE-2026-81787 — WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Authentication vulnerability
- CVE-2026-81783 — WordPress MailMunch – Grow your Email List plugin <= 3.2.5 - Broken Authentication vulnerability
- CVE-2026-88861 — Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization
- CVE-2026-86084 — n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions
- CVE-2026-83527 — An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a...
- CVE-2026-62650 — A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side...
- CVE-2026-76169 — fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers