CVE-2026-60011

Executive Summary

CVE-2026-60011 is an authorization bypass vulnerability affecting Sharp and Toshiba Tec multifunction printers (MFPs), specifically in the handling of direct image data access requests. The flaw allows unauthenticated remote attackers to access sensitive scanned or stored image data without proper authorization checks, violating CWE-425 (Direct Request 'Forced Browsing'). The vulnerability currently carries a CVSS score of 5.3 (Medium) and remains unpatched with a patch confidence of 0/4, meaning no vendor fix has been released. Given the prevalence of MFPs in enterprise environments and the sensitive nature of scanned documents (contracts, PII, financial records), the confidentiality impact — though rated Low in the CVSS vector — can translate to significant organizational risk depending on what data traverses the device.

Technical Analysis

The vulnerability resides in the web-based administrative/control interface of Sharp and Toshiba Tec MFPs. The core mechanism is a failure of the authorization layer to enforce access controls on specific HTTP endpoints responsible for retrieving image data stored on the device. MFPs typically store scanned documents in temporary spool directories or hot-folder storage areas before routing them to their final destination (email, network share, or USB). These storage locations are accessible via internal web services, often as raw binary endpoints that return TIFF, PDF, or JPEG data.

The authorization failure is present in the request-handling logic: when a crafted HTTP request targets these image-retrieval endpoints, the application fails to validate session tokens, IP allowlists, or role-based access control (RBAC) attributes. This is distinct from a path traversal (CWE-22), because the flaw is not about escaping a directory — it is about the server not authenticating the requester at all when serving stored content. The endpoint likely uses a predictable URL pattern or relies on a filename/UUID that can be enumerated, combined with the lack of session validation.

At the code level, the vulnerability pattern resembles:

// Vulnerable pseudocode
def get_image(request):
    image_id = request.GET.get('image_id')
    # MISSING: session validation, permission check, or IP restriction
    file_path = os.path.join(STORAGE_DIR, image_id)
    return send_file(file_path)

The attack surface is the network-facing HTTP/HTTPS management port (typically 80/443, 5000, or 8080 depending on model). Many MFPs ship with default administrative credentials and are often deployed on internal networks with broad segmentation or directly exposed to the internet due to remote printing needs. The vulnerability is network-reachable (AV:N) with no privileges required (PR:N) and no user interaction (UI:N), per the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

The EPSS score of 0.00231 (14.1% percentile) indicates the vulnerability is not yet widely exploited in the wild, but does not diminish its practical exploitability — the attack complexity is low (AC:L) and public PoC references exist. The lack of a published CNA title or vendor identification suggests this may have been assigned by a third-party researcher or an upstream CVE processor that consolidated two vendor product lines under one identifier.

Exploitation Scenarios

Scenario 1: Unauthenticated Document Theft from Internet-Facing MFP

1. Reconnaissance: The attacker uses Shodan or Censys with search queries such as http.title:"Sharp" MFP or server:"Toshiba Tec" to locate exposed printer management interfaces. Alternatively, internal reconnaissance via ARP scanning identifies MFPs on the corporate network.
2. Endpoint Discovery: Once the IP is identified, the attacker probes the web interface for known image-retrieval paths. Common patterns to test include /cgi-bin/fetch_image.cgi, /document/get?id=, /scan/data/retrieve.php, or /histlog/image. The attacker enumerates a range of sequential IDs (e.g., ?id=0 through id=9999) to find valid image references.
3. Weaponization/Trigger: The attacker constructs a direct HTTP GET request, e.g., GET /document/retrieve?scan_id=42&format=pdf HTTP/1.1 with no session cookie or Authorization header. Because the authorization middleware is absent for this route, the server responds with the binary image data (200 OK with Content-Type: application/pdf or image/tiff).
4. Payload/Execution: The attacker writes a simple Python script using the requests library to iterate through scan_ID values, saving each response to disk. On a busy MFP that scans hundreds of documents daily, a short enumeration window captures emails, legal documents, HR forms, and other sensitive material.
5. Post-Exploitation Impact: The attacker now possesses confidential documents. They may use extracted PII for credential-stuffing, sell the data, or use internal knowledge for further social engineering against the organization.

Scenario 2: Lateral Movement and Data Exfiltration

1. Initial Access: An attacker who has already compromised a workstation on the same network segment as the MFP (e.g., via phishing) identifies the printer IP via arp -a or by querying the default gateway's ARP cache.
2. Trigger: Without escalating privileges on the workstation, the attacker runs curl http://192.168.1.50:8080/webCapture/getScanFile?file=2026-03-15_scan.pdf — again relying on the missing authorization check. Since the vulnerability requires no authentication, the attacker does not need any additional foothold.
3. Exfiltration: The attacker batches the retrieval: for i in $(seq 1 1000); do curl -o /tmp/scans/$i.pdf http://printer/webCapture/getScanFile?id=$i; done. The files are then compressed and sent via DNS tunneling or HTTPS to an external C2, sidestepping DLP controls that may not inspect MFP source traffic.
4. Impact: The exposure of meta-data (device logs, stored images) may also reveal network topology, internal hostnames, or credentials embedded in scanned configuration sheets.

Impact Assessment

The CVSS score of 5.3 (Medium) reflects a Low confidentiality impact with no integrity or availability impact. However, this rating is deceptive in the context of printer data. MFPs process and temporarily store some of the most sensitive information in an enterprise: employee medical records, signed legal contracts, checks, and proprietary engineering drawings. An attacker harvesting even a single day's scans could obtain documents that justify elevating the practical severity to High for most organizations.

The blast radius is bounded by the device's storage capacity and usage pattern. Modern MFPs typically hold 1,000–10,000 scanned pages in internal storage. The attack requires only network access (no credentials), making it trivial to chain with other network-based exploitation techniques. Because no integrity impact exists (I:N), the attacker cannot modify documents or plant malware via this specific CVE — but the stolen data itself is the payload.

Affected systems include:

• Sharp MFP series (all models running the vulnerable firmware without the pending patch)
• Toshiba Tec e-STUDIO series (all versions shipping before the fix)
• Any enterprise that has deployed these devices with the default management interface enabled on a routable network

The confidentiality subscore (C:L) is the sole impact component. The attack scope is "Unchanged" (S:U), meaning the exploited component (the web service) and the impacted component (stored document store) are on the same system — there is no privilege boundary crossing, which is accurate given the attacker never authenticates and only reads what the service can already read.

Detection Guidance

Sigma Rule

title: Sharp/Toshiba Tec MFP - Unauthenticated Image Retrieval Attempt
id: 9f4c2a11-6e2d-4f1b-9c3d-1a2b3c4d5e6f
status: experimental
description: Detects HTTP requests to MFP image retrieval endpoints lacking authentication headers or session cookies.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-60011
tags:
    - attack.t1190
    - attack.t1213
logsource:
    category: webserver
    product: mfp
    service: http
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains:
            - '/getScanFile'
            - '/document/retrieve'
            - '/webCapture/image'
            - '/histlog/show'
            - '/scan/data/retrieve'
    filter_authenticated:
        cs-cookie: 'JSESSIONID*'
    filter_known_clients:
        c-ip|startswith:
            - '10.0.0.'  # Replace with known scanning clients that access the web UI
            - '192.168.1.'
    condition: selection and not (filter_authenticated or filter_known_clients)
    timeframe: 5m
level: high
falsepositives:
    - Automated print-job notification scripts that legitimately poll the endpoint
    - Administrator performing manual document retrieval without authentication (misconfiguration)

YARA Rule

rule CVE_2026_60011_MFP_Image_Request {
    meta:
        author = "Valtersi Threat Intel Team"
        description = "Detects suspicious HTTP GET requests targeting MFP document retrieval endpoints without authentication"
        cve = "CVE-2026-60011"
        date = "2026-03-25"
    strings:
        $path1 = "/getScanFile" ascii
        $path2 = "/document/retrieve" ascii
        $path3 = "/webCapture/image" ascii
        $path4 = "/histlog/show" ascii
        $path5 = "/scan/data/retrieve" ascii
        $range = "id=" ascii
        $seq = "seq=" ascii
        $cookie = "Cookie:" ascii nocase
        $pfx = "GET " ascii
    condition:
        uint16(0) == 0x4745 and // GET
        $pfx at 0 and
        any of ($path*) and
        (#range > 5) and // rapid ID enumeration
        (not $cookie or filesize < 512) // minimal headers suggests scripting
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-60011 Potential Sharp/Toshiba MFP Unauthenticated Image Retrieval"; flow:established,to_server; content:"GET"; http_method; content:"/getScanFile"; http_uri; content:"/document/retrieve"; http_uri; content:"/webCapture/image"; http_uri; content:"/histlog/show"; http_uri; content:"/scan/data/retrieve"; http_uri; pcre:"/(getScanFile|document\/retrieve|webCapture\/image|histlog\/show|scan\/data\/retrieve)/"; classtype:attempted-recon; sid:202660011; rev:1; metadata:created_at 2026-03-25, cve CVE-2026-60011;)

Elastic Detection

// EQL query for Elastic Security
sequence by source.ip
  [network where event.category == "web" and
   http.request.method == "GET" and
   (http.request.uri.text contains "/getScanFile" or
    http.request.uri.text contains "/document/retrieve" or
    http.request.uri.text contains "/webCapture/image" or
    http.request.uri.text contains "/histlog/show" or
    http.request.uri.text contains "/scan/data/retrieve") and
   not http.request.headers.cookie exists and
   not http.request.headers.authorization exists]
  [network where event.category == "web" and
   http.request.uri.text matches "\?id=[0-9]+" and
   event.duration > 100]

Splunk SPL Query

index=proxy OR index=web
| where method="GET"
| where uris like "%getScanFile%" OR uris like "%document/retrieve%" OR uris like "%webCapture/image%" OR uris like "%histlog/show%" OR uris like "%scan/data/retrieve%"
| rename src_ip as src, dest_ip as dest, host as webserver
| eval has_cookie = if(match(headers, "(?i)cookie:"), "yes", "no")
| where has_cookie="no"
| where match(uris, "\?id=[0-9]+")
| stats count by src, dest, webserver, uris, _time
| sort -count
| eval severity = case(count > 50, "HIGH", count > 10, "MEDIUM", true, "LOW")
| table _time, src, dest, webserver, uris, count, severity

Wazuh OSSEC Rule

<group name="mfp,">

  <rule id="318731" level="10">
    <decoded_as>json</decoded_as>
    <field name="event.type">webserver-access</field>
    <regex>(.*)(getScanFile|document/retrieve|webCapture/image|histlog/show|scan/data/retrieve)(.*)</regex>
    <description>CVE-2026-60011: Unauthenticated access to MFP image retrieval endpoint detected.</description>
    <group>access_control,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="318732" level="13" frequency="10" timeframe="120">
    <if_matched_sid>20260011</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-60011: Rapid enumeration of MFP document IDs from a single source.</description>
    <group>command_and_control,</group>
  </rule>

</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor has not released a fix; treat this as actively exploitable.

1. Immediate Mitigations:

   • Network Segmentation: Place all MFPs in a dedicated VLAN with strict firewall rules. Restrict access to the management interface (ports 80/443/8080) to only administrative workstations via IP allowlist.
   • Disable Unused Web Services: Access the MFP's control panel or web console and disable any document preview, scan history, and network scan-to-folder web features that expose image retrieval.
   • Access Control: Change default administrative passwords and disable anonymous access to the web interface where supported.
   • Monitor: Run the detection rules provided above to identify ongoing exploitation attempts.

2. Patch/Upgrade Steps:

   • As no vendor patch exists, contact Sharp and Toshiba Tec support channels directly and request a firmware security advisory. Subscribe to their security bulletin RSS feeds to be notified of firmware updates.
   • Apply the latest available firmware updates from Sharp and Toshiba Tec, even if they do not explicitly reference this CVE — they may include defense-in-depth improvements.

3. Long-Term Hardening:

   • TLS Configuration: Force HTTPS with mutual TLS if the MFP supports client certificate authentication, mitigating unauthenticated access even if the authorization flaw is not patched.
   • Data Minimization: Configure MFPs to encrypt scanned data at rest and to auto-purge stored scans after 24–48 hours, limiting the window for data theft.
   • Logging: Ensure the MFP sends syslog events to a central SIEM, capturing all web interface requests.
   • Decommission Legacy Devices: If the MFP model is end-of-life and cannot receive updates, replace it or strictly isolate it from the rest of the network.
   • Vendor Patching Triage: Add CVE-2026-60011 to a watchlist with a recurring 30-day vendor check. Given the 0/4 patch confidence, escalate to senior management if the device handles regulated data (HIPAA, GDPR, PCI-DSS).

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-60011 — Official NVD record with CVSS vector and description.
2. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application, the primary technique for this flaw.
3. CWE-425 Direct Request: https://cwe.mitre.org/data/definitions/425.html — Common Weakness Enumeration entry detailing the forced-browsing class.
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Not listed on the KEV as of this report, but monitor for updates.
5. Sharp Security Advisories Portal: https://global.sharp/company/security/ — Vendor advisory page to monitor for future firmware patches.

Threat Actor Activity: No known threat actor campaigns have been documented as of this report. The EPSS score of 0.00231 (14.1% percentile) suggests limited real-world exploitation, but the availability of public PoC references implies the barrier to weaponization is low. Organizations should treat this as a latent risk pending vendor action.