CVE-2026-63545

Executive Summary

CVE-2026-63545 is an information disclosure vulnerability affecting Sharp and Toshiba Tec multifunction printers (MFPs). The flaw stems from the device's internal caching mechanism during print operations, which fails to clear cached data after job completion, potentially exposing sensitive printed material to subsequent users. With a CVSS score of 2.4 (Low severity), the vulnerability requires physical access to the device and is characterized by low confidentiality impact with no integrity or availability concerns. As of this report, the vulnerability remains unpatched with no public proof-of-concept or exploitation evidence.

Technical Analysis

Vulnerability Mechanism

The vulnerability resides in the print job management subsystem of Sharp and Toshiba Tec MFPs. When a document is submitted for printing, the MFP's internal storage — typically a hard disk drive (HDD) or solid-state drive (SSD) — caches the print data as part of the rendering and spooling process. This cached data includes:

• Rendered page images (TIFF, PDF, or vendor-proprietary raster formats)
• Print job metadata (submitter name, timestamp, document title)
• Partial or complete raw print streams (PCL, PostScript, or proprietary PDL data)

The core defect is the failure to purge this cache after job completion, print job cancellation, or device reboot. The data persists in the device's storage subsystem, accessible to any subsequent user who interacts with the device's embedded web server, control panel, or file management interfaces.

Attack Surface

The attack surface includes:

1. Embedded Web Server: Most Sharp/Toshiba MFPs expose a web-based administration interface (typically port 80/443) that may include "stored job" or "document file" browsing capabilities.
2. Control Panel Access: Physical interaction with the device's touchscreen can access "job history" or "stored documents" functions.
3. FTP/SMB Share Interfaces: Some models enable direct file access to the internal storage via network shares if misconfigured.
4. USB Host Ports: Direct storage enumeration via USB mass storage connection may expose cached data.

Code-Level Considerations

While public technical disclosures are limited, the vulnerability class (CWE-459 — Incomplete Cleanup) typically manifests in firmware code paths where:

• The spooler module writes print data to a designated cache directory but fails to invoke secure deletion routines (e.g., unlink() without overwrite, or firmware_erase() calls that skip NAND wear-leveling blocks).
• The job deletion API returns success to the user interface without actually clearing the storage-backed queue.
• Factory reset or "clear all jobs" functions only clear the job list index, not the underlying data blocks.

Exploitation Scenarios

The following attack chain assumes physical access to the MFP device, as the CVSS vector dictates (AV:P — Physical).

1) Reconnaissance / Target Identification

The attacker identifies Sharp or Toshiba Tec MFP devices within the target facility. Reconnaissance steps include:

• Network scanning: Use nmap -p 80,443,631,9100 --script http-title <target_range> to identify printer web interfaces. Sharp devices often respond with "SHARP Digital Full Color Multifunctional System" titles; Toshiba Tec devices respond with "e-STUDIO" branding.
• Shodan search: Query http.title:"Sharp" && http.title:"MFP" or http.title:"e-STUDIO" to identify publicly exposed devices.
• Physical reconnaissance: Identify MFP locations in common areas, print rooms, or shared office zones with high user traffic (e.g., near elevators, mailrooms).

2) Trigger / Weaponization

With proximity to the device, the attacker attempts to access cached print data:

• Via Control Panel: Navigate to the MFP's "Job Status" or "Document Filing" menu. On many Sharp OSA (Open Systems Architecture) models, pressing "Job Status" → "Print Queue" → "Show Details" reveals thumbnails or metadata of recently processed jobs. If the prior user's job appears, the attacker can attempt to "Reprint" or "View" the cached page images.
• Via Web Interface: Access the device's IP via browser, authenticate using default credentials (e.g., admin/admin, admin/123456 — common on many Sharp/Toshiba units), navigate to "Job History" or "Document Files" pages, and download embedded previews or re-print cached documents.
• Via Direct Storage Enumeration: If the device exposes an SMB/CIFS share (e.g., \\\\<device-ip>\\STORAGE), attempt to list directories under the print spool path. On Toshiba e-STUDIO models, common paths include /spool/ or /printdata/.

3) Payload / Execution

• Job Reprint Attack: From the control panel or web UI, select a cached job belonging to the prior user and issue a "Reprint" command. The device renders the cached page images to the output tray, producing a physical copy of the victim's printed document.
• Data Exfiltration via Web UI: If the web interface supports document preview or download (e.g., as PDF thumbnails), download the cached job data directly to the attacker's laptop via a browser.
• Storage Image Extraction: If physical access to the device is unrestricted, the attacker may remove the internal HDD (on models with field-replaceable storage) and mount it offline using a forensic write-blocker, extracting raw print spool files with tools like dd and photorec.

4) Post-Exploitation Impact

• The attacker obtains confidential printed material (contracts, HR records, financial reports) without triggering standard monitoring (no malware, no network intrusion).
• The cached data can be used for further targeting (spear-phishing, blackmail) or direct financial fraud if credentials/PII are present in printed documents.
• Repeated exploitation enables persistent information theft from any user who prints on the device, turning the MFP into a silent data collection point.

Impact Assessment

Business Impact

• Confidentiality breach: Low severity but potentially high consequence if sensitive documents (NDAs, patient records, legal briefs) are printed on shared MFPs. The low CVSS score reflects the physical attack vector and single-victim scope, but cumulative exposure over time can be significant.
• Regulatory risk: Printing of GDPR-protected personal data, HIPAA-covered health information, or PCI-DSS cardholder data that is retrieved by unauthorized parties constitutes a reportable data breach in most jurisdictions.
• Reputation: Discovery of this flaw in an enterprise environment undermines trust in the organization's data-handling practices.

Affected Systems

• Sharp MFP product lines: likely includes MX, BP, and AR series produced after 2018 (specific models unconfirmed due to vendor disclosure gaps).
• Toshiba Tec MFP product lines: likely includes e-STUDIO series with embedded HDD storage options (e.g., 2500AC, 3500AC, 5000AC lines).

Blast Radius

• CVSS subscores: C:L/I:N/A:N — confidentiality impact limited to cached print data; no integrity or availability impact. Attack complexity is Low, requiring no privileges (PR:N) and no user interaction (UI:N). Scope is Unchanged (S:U).

Detection Guidance

Sigma Rule

title: Sharp/Toshiba MFP Cache Data Access Attempt
id: 5f4cb2c4-7b9e-4d29-a5c6-9c9e3b1d7e2a
status: experimental
description: Detects attempts to access cached print job data on Sharp and Toshiba Tec MFP devices via web interface job history endpoints.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-63545
author: Valtersit Threat Intel Team
date: 2026/11/01
logsource:
    category: webserver
    product: multifunction_printer
detection:
    selection_web:
        cs-method: GET
        cs-uri-query|contains:
            - 'jobhistory'
            - 'storedjob'
            - 'docfiling'
            - 'joblist'
            - 'storagesearch'
            - 'file.asp'
    selection_auth:
        sc-status: 200
        cs-username|startswith: 'admin'
    condition: selection_web and selection_auth
falsepositives:
    - Legitimate administrator maintenance checks
level: low

YARA Rule

rule MFP_Cached_Print_Job_Banner
{
    meta:
        author = "Valtersit Threat Intel Team"
        description = "Detects cached print job data files on Sharp and Toshiba Tec MFP storage"
        cve = "CVE-2026-63545"
        date = "2026-11-01"
    strings:
        $sharp_header = "Sharp MFP" ascii wide nocase
        $toshiba_header = "e-STUDIO" ascii wide nocase
        $pdf_container = ".pdf" ascii nocase
        $tiff_container = ".tiff" ascii nocase
        $print_job_id = "JOBID" ascii nocase
        $spool_path = "/spool/" ascii nocase
        $render_cache = "RENDER_CACHE" ascii nocase
    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or uint8(0) == 0xFF and uint8(1) == 0xD8) and 
        2 of ($pdf_container, $tiff_container, $print_job_id, $render_cache) and
        1 of ($sharp_header, $toshiba_header, $spool_path)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-63545 Potential MFP Stored Job Data Access"; flow:established,to_server; content:"GET"; http_method; content:"jobhistory"; http_uri; nocase; content:"joblist"; http_uri; nocase; sid:202663545; rev:1; reference:cve,CVE-2026-63545; classtype:attempted-recon; metadata:created_at 2026_11_01, updated_at 2026_11_01, attack_target_printer, deployment_perimeter, tag_print_job_exfiltration;)

Elastic Detection

// Detect access to MFP job history endpoints from non-standard admin time periods
sequence by host.ip, user.name with maxspan=10m
  [network where process.name == "chrome.exe" or process.name == "firefox.exe" and destination.port in (80, 443)]
  [http where url.path in ("/jobhistory", "/storedjob", "/docfiling", "/joblist") and http.response.status_code == 200]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%jobhistory%") 
   OR like(uri_path, "%storedjob%")
   OR like(uri_path, "%docfiling%")
   OR like(uri_path, "%joblist%")
| eval is_printer = if(match(useragent, "(?i)sharp|e-studio|toshiba"), "MFP", "Unknown")
| where is_printer = "MFP"
| stats count by clientip, uri_path, status, _time
| sort - _time

Wazuh OSSEC Rule

<group name="mfp,cve2026">
  <rule id="100635" level="5" frequency="3" timeframe="300">
    <decoded_as>web-access</decoded_as>
    <match>jobhistory|storedjob|docfiling|joblist|storagesearch</match>
    <description>Repeated access attempts to MFP cached print job data endpoints (CVE-2026-63545)</description>
    <group>mfp_access,vulnerability,</group>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. The vendor fix is not yet available.

1) Immediate Mitigations

• Enable auto-delete of stored jobs: On the MFP control panel, navigate to Settings → System → Job Settings → "Auto Delete Stored Jobs" and set to the shortest interval (e.g., 1 hour or immediate).
• Disable job storage: If not business-critical, disable the "Document Filing" or "Job Retain" feature entirely via the device's admin web interface or user utility.
• Restrict network access: Block inbound access to the MFP's web interface (ports 80/443/631/9100) from non-admin subnets via firewall rules.
• Change default admin credentials: Audit all Sharp/Toshiba MFPs; change from default admin/admin or admin/123456 to strong unique passwords.
• Enable secure erase on delete: If the device supports "Secure Erase" (overwrite with random data multiple passes), enable this in the storage settings.
• Physical access controls: Place MFPs in controlled areas with keycard access; prohibit unsupervised access to the control panel where possible.

2) Patch / Upgrade Steps

• Check vendor portals weekly: Monitor sharpusa.com/support and business.toshiba.com/support for firmware advisories referencing CVE-2026-63545 or "print data cache clearing."
• Apply firmware updates: When released, stage the firmware upgrade via the admin web interface (typically under "Firmware Update" in Settings), test on a pilot device first.
• Track CVE status: Subscribe to NVD email alerts for CVE-2026-63545 to receive automatic notifications of vendor patches or configuration workarounds.

3) Long-Term Hardening

• Implement MFP security baseline: Develop and enforce a configuration standard that includes: secure storage encryption (AES-256 HDD encryption on supported models), automatic cache purge (immediate or at-off, pre-shutdown), disable USB host ports, and disable direct SMB/FTP shares.
• Network segmentation: Place MFPs on a dedicated print VLAN with egress filtering; deny access to the device management interface from the general user network.
• Procurement policy: When purchasing new MFPs, require vendor documentation confirming FIPS 140-2 validated encryption for at-rest storage and immediate secure deletion of spool data.
• Audit logs: Enable and centrally collect the device's syslog output, forwarding to the SIEM (via Splunk/Elastic) for monitoring of "job history access" events.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-63545 — National Vulnerability Database official record.
2. CWE-459: https://cwe.mitre.org/data/definitions/459.html — Incomplete Cleanup weakness description.
3. Sharp Support Portal: https://www.sharpusa.com/support — Vendor product support and firmware update center.
4. Toshiba Tec Business Solutions: https://business.toshiba.com/support — Vendor support portal for e-STUDIO MFP series.
5. MITRE ATT&CK T1213: https://attack.mitre.org/techniques/T1213/ — Data from Information Repositories technique, relevant for the "Job History" access pattern.

Threat Actor Campaigns: No known threat actor campaigns, exploit-in-the-wild evidence, or CISA KEV listing (confirmed NO) associated with CVE-2026-63545 as of this report date. Monitoring continues for Foothold/ExploitDB postings and vendor firmware changelogs containing this CVE reference.